Have separate secure and non-secure public builds

Our security concept doesn't allow us to move artifacts built in non-secure environments to secure environments.
This means we'll have to make sure that the boxes we release are built on a runner marked as
'secure'.

.gitlab-ci.yml

@@ -20,7 +20,7 @@ shfmt:
   script:
     - shfmt -i 2 -ci -d **/*.sh
 
-build:
+.build:
   stage: build
   before_script:
     - pacman -Syu --needed --noconfirm qemu-headless libisoburn
@@ -29,6 +29,18 @@ build:
     - . build.env
     - ./build-in-qemu.sh
     - mv build.env output/
+
+build:
+  extends: .build
+  except:
+    - master
+
+build:release:
+  extends: .build
+  tags:
+    - secure
+  only:
+    - master
   artifacts:
     name: "output"
     paths: