Disable Canonical push mirror during security merge, then re-enable during publishing

Use gitlab-org/gitlab!22433 (merged) to toggle a mirror off and then back on at key points in a security release cycle in order to avoid commit leaks in the Canonical repository.