.gitlab-ci.yml: require samba-ci-private tag for our private runners