Hide some potentially dangerous jobs behind a CI variable

While this is not a security mechanism as anyone with push access to the protected branches can also just set CI variable, it just avoid triggering these potentially dangerous CI jobs accidentally, e.g. by misclicking in the web UI.