Make sure that we can run CI on infra teams' runners

[krzysztofczyz-da]

For context:

• as a part of porting infra_up I've ran into errors related to lock ownership
• in particular $SPLICE_ROOT/build-tools/approved-by.sh could not execute as the job did not have CCI token (and it does not make sense under GHA anyway)
• from a quick search it seems that the logic cannot really be replicated 1:1 under GHA as deployments don't have a direct API for this (unless we're speaking about approval from forks, than we have this endpoint)
• the closest thing would be a github actor (if we're talking about running workflows from GHA UI) or maybe custom deployment protection rule