fix(actions): don't pick up jobs of repos with Actions disabled (#40106) (#40122)

Backport https://github.com/go-gitea/gitea/pull/40106

Repository-level and instance-level runners still picked up waiting jobs
of repositories with Actions disabled.
https://github.com/go-gitea/gitea/pull/30331 only covered owner-level
runners, by filtering them out in SQL.

Pickup now checks the Actions unit of each job it is about to claim, for
every runner scope, and cancels the job instead when Actions is
disabled, also honoring `DISABLED_REPO_UNITS`. Disabling Actions
therefore cancels its queued jobs once a matching runner polls, instead
of leaving them waiting until `ABANDONED_JOB_TIMEOUT`.

Co-authored-by: silverwind <me@silverwind.io>

tests/integration/actions_concurrent_claim_test.go

@@ -89,15 +89,14 @@ func TestCreateTaskForRunnerConcurrentClaim(t *testing.T) {
 	// as happens when all see the same stale tasksVersion simultaneously.
 	type result struct {
 		task *actions_model.ActionTask
-		ok   bool
 		err  error
 	}
 	results := make([]result, numJobs)
 	var wg sync.WaitGroup
 	for i := range numJobs {
 		wg.Go(func() {
-			task, ok, err := actions_model.CreateTaskForRunner(t.Context(), runners[i])
-			results[i] = result{task, ok, err}
+			task, _, err := actions_model.CreateTaskForRunner(t.Context(), runners[i])
+			results[i] = result{task, err}
 		})
 	}
 	wg.Wait()
@@ -106,8 +105,7 @@ func TestCreateTaskForRunnerConcurrentClaim(t *testing.T) {
 	claimedJobIDs := make(map[int64]bool)
 	for i, r := range results {
 		require.NoError(t, r.err, "runner %d got an unexpected error", i)
-		require.True(t, r.ok, "runner %d did not get a task even though free jobs exist", i)
-		require.NotNil(t, r.task)
+		require.NotNil(t, r.task, "runner %d did not get a task even though free jobs exist", i)
 		assert.False(t, claimedJobIDs[r.task.JobID], "job %d was claimed by more than one runner", r.task.JobID)
 		claimedJobIDs[r.task.JobID] = true
 	}