ci: make duo_job run automatically on all MRs

What does this MR do?

Changes the duo_job configuration to run automatically on all MRs instead of being manual. The job will be required to pass unless the MR has the duo-ui-allowed-to-fail label.

Changes:

• Moves duo_job from manual stage to deploy stage
• Makes the job run automatically on all MRs
• Adds label-based failure control

How to control job behavior

• By default: Job must pass for MR to be merged
• With label: Add duo-ui-allowed-to-fail label to allow the job to fail without blocking the MR

How to verifiy

• I broke the Duo-UI Downstream job during development on purpose
• Example Pipeline without label: https://gitlab.com/gitlab-org/gitlab-ui/-/pipelines/1646250093
• Example Pipeline with label: https://gitlab.com/gitlab-org/gitlab-ui/-/pipelines/1645722058