Prevent unattended upgrade of GitLab major releases

Over the last weekend, GitLab was upgraded by unattended-upgrades to 15.0. Although the upgrade seems to have worked fine, several people noticed some cosmetic changes and were a little worried, but TPA staff were away.

We should pin the gitlab-ce package to 15.x so that in the future, we don't upgrade to GitLab 16.0 in unattended mode so we can plan and announce such upgrades accordingly.