validate CI files

This hijacks the GitLab CI lint API:

https://docs.gitlab.com/ee/api/lint.html

It is possibly a little optimistic about the CI_JOB_TOKEN, but we'll see.

it works locally with an API token created by hand for my user.