Require manual trigger (always) for the "Upgrade status" job

#3572380 will help a lot, since that's where most of the action is. But we've also got RUN_JOB_UPGRADE_STATUS. I'm seeing contrib maintainers put this in their default .gitlab-ci.yml files. This is absurd. 😬 This is a job that needs to maybe be run a handful of times, once every two years when you're actively porting your module to the next core major version. Under no circumstances should it run on every push to every MR, year in and year out.

I'm (grudgingly) okay putting #3572380 behind an flag, so that it doesn't immediately happen all at once, and folks could revert to the current, wasteful behavior if they really insist.

But for RUN_JOB_UPGRADE_STATUS I can't fathom any scenario where running that repeatedly is a good idea. It should always be when: manual.