Allow DAST validation and on-demand scan jobs to be run on runners with specific tags

Proposal

Allow the DAST validation jobs and on-demand scan jobs to be run on runners with a specific tag. In situations where shared instance runners are required by company policy, it would be beneficial to define specific or tagged runners to the validation or on-demand scans. This could be to enhance security if shared instance runners are not internet-connected. Special runners with a tag can be used to mark runners that have internet access. The DAST jobs can then run on-demand scans and server validations.

This is related to a customer issue (internal link): https://gitlab.zendesk.com/agent/tickets/575717