Sbuild workflow denylists

MUST: Implement a workflow step that schedules all the binary builds (as new dedicated workflows?) required for a new source upload to target distribution. Support a denylist so that some packages are never tried on some specific architectures Support a denylist of workers so that some packages are never tried on some specific workers

The first part of this is already done via the sbuild workflow (#353 (closed)). But the denylists are not yet designed/implemented.