Related to: https://gitlab.com/gitlab-org/gitlab/-/issues/389060 Rollout issue: https://gitlab.com/gitlab-org/gitlab/-/issues/468320 MRs: 1. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/152096 2. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/154111 CI_JOB_TOKEN allows to clone private repo, but doesn't allow to push back to the same repo. This issue is a follow-up to create such protection before we can release this feature - https://gitlab.com/gitlab-org/gitlab/-/issues/468320 A main concern is an infinitive loop - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/154111#note_1940996093 ### Other Requirements Please ping `@hsutor` in [this](https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/137190) MR once this issue is complete so we can officially transition CI_Job_Token to ~"group::authentication"