Add some allowed-projects restrictions to publish jobs
Add some allowed-projects restrictions to publish jobs

Jobs that publish to specific places like these need to be locked down
to only being able to be run on their own repo.

Also, checking to make sure these were all set final: true showed that
we were missing final: true on build-wheel-mirror. Nobody should be
inheriting from that.

Change-Id: I51acb419a087cb4d4d814750ac04a008cdd3f2b4

openstack-infra/project-config,openstack-infra/project-config