Mark CI jobs that need secrets with environments

This allows us to restrict access tokens / SSH keys to the particular job
instead of allowing all jobs to access the secrets.

Author: PhilippWendler

build/gitlab-ci.yml

@@ -250,6 +250,7 @@ deploy-gh-pages:
   needs:
     - build:jdk-11
     - javadoc
+  environment: deploy/gh-pages
   only:
     variables:
       - $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # only on default branch