Heartbeat runner only for specific job-context requests

What does this MR do and why?

Addresses the problem discussed at !32851 (comment 740189809).

In short: some operations made by Runner and authenticated by job token (at this moment: artifacts downloads and uploads) should not trigger heartbeat. In many cases it will set invalid IP address. And the artifact downloads - as they may be done in the future, from a totally different job and runner - will update the contacted_at status of a totally unrelated runner.

This MR aims to fix this problem. It adds a second configuration option to the authenticate_job! method - disabled by default - which is then enabled explicitly only for the API endpoints that should trigger the heartbeat.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.