docs: add ADR 0043 — GitLab per-repo support via CI_JOB_TOKEN and webhook bridge

Supersedes ADR 0028 (deprecated). Redesigns GitLab support around
per-repo-only installation, using CI_JOB_TOKEN as the primary credential
instead of per-role PATs in Secret Manager. Eliminates the need for the
token mint, WIF, and central .fullsend project for GitLab.

Includes companion implementation plan with 6 phased build-out,
security-critical code path analysis, and verification checklist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Greg Allen <gallen@redhat.com>

Author: ggallen