Deploy Runner Shard for Duo Workflow

Related to gitlab-com/content-sites/handbook!10875 (comment 2291956941) we want to deploy a shard for running Duo Workflow jobs.

We can use the tag duo-workflow for this.

We would like:

  1. To ensure that Duo Workflow jobs always end up on a Duo Workflow runner
  2. Ensure that no other non-Duo Workflow CI jobs end up on a Duo Workflow runner
  3. Have the same pricing as normal CI pipelines for now but have the option to adjust that in future
  4. Provide customers with some ability to control network firewalls for Duo Agent Platform runs (gitlab#557204)
Edited by Dylan Griffith (ex GitLab)