Chainguard self-test blocks every fork merge request

Summary

The Chainguard self-test (chainguard_auth, gated by .chainguard_self_test_rules in .gitlab-ci.yml) runs on merge requests raised from forks, where it cannot pass, so it blocks every fork merge request.

Steps to reproduce

  1. Fork this project.
  2. Raise a merge request from the fork back to gitlab-com/gl-infra/common-ci-tasks.
  3. The merge request pipeline runs chainguard_auth.

What happens

chainguard_auth fails with:

unable to exchange tokens: PermissionDenied
token has invalid subject: project_path:<fork>:ref_type:branch:ref:...

Chainguard only trusts a token minted under a gl-infra project path, so a fork can never pass this job, and it blocks the merge request.

Root cause

The guard in .chainguard_self_test_rules excludes fork merge requests with:

$CI_MERGE_REQUEST_SOURCE_PROJECT_ID != $CI_PROJECT_ID

A fork's merge request pipeline runs in the fork, so CI_PROJECT_ID is the fork's own id, which equals CI_MERGE_REQUEST_SOURCE_PROJECT_ID. The when: never rule never fires, and chainguard_auth runs anyway.

Suggested fix

Compare the source project against the merge request's target project instead:

$CI_MERGE_REQUEST_SOURCE_PROJECT_ID != $CI_MERGE_REQUEST_PROJECT_ID

A fork merge request is then excluded wherever its pipeline runs, and a branch raised inside this project is unaffected.

Spotted while working on !1932 (merged); per review it is being split out into its own issue and dedicated merge request.