.gitlab-ci.yml: hardcode prebuilt image URLs for forks to use them
update-crypto-policies: add ruff ignore for positional arguments