Remove sensitive files from build slaves

[James E. Blair]

  make sure gerrit trigger plugin runs from master
  gpg key only on master, make ppa upload jobs only run on master
  ssh key only on master, make scp jobs only run on master
  launch new build slaves from master, with secret files (like for glance) in place

[Jeremy Stanley (fungi)]

I think most of this is done? I'll see what I can do to confirm and then resolve this and switch to public security.

[Jeremy Stanley (fungi)]

The gerrit trigger plugin has been replaced by zuul. At this point we no longer have any OpenPGP keys or GnuPG usage in CI tooling and automation (this will change soon, but when it does we'll do it correctly and safely). We no longer perform automated PPA uploads. The Jenkins SSH keys are only on the puppet master, Jenkins masters (we have several now) and nodepool (which is now responsible for launching new disposable Jenkins slaves). Credentials to third-party systems are currently relegated to single-use slaves (pypi, proposal), or removed (Glance remote service keys).