gitlab_runner: Prevent the VMs from doing MAC, IP and ARP spoofing

roles/gitlab_runner/files/domain_template.xml

@@ -28,6 +28,7 @@
     <interface type='network'>
       <source network='default'/>
       <model type='virtio'/>
+      <filterref filter='clean-traffic'/>
     </interface>
     <rng model='virtio'>
       <backend model='random'>/dev/urandom</backend>