Improve WorkflowTemplate to provide more flexibility on allowed input parameters

Workflow templates can specify a subset of the input parameters for their workflow that cannot be overridden by the user starting the workflow; the parameters not set in the workflow template are called run-time parameters, and can be provided by the user.

This is adequate for some use cases, and it is a good fit for situations where some of the input parameters are security-sensitive. However, it is not enough for others. For example:

• Create a debian_pipeline workflow template that defaults to uploading the package to an upload target, butallow the user to skip the upload step
• Default autopkgtest_backend to unshare, but allow the user to select another backend, perhaps with some restrictions (#803)
• Forbid setting a particular parameter, while relying on the workflow's default value rather than needing to specify one
• Ensure that changes to the implementation of a workflow don't unexpectedly make new parameters available

(split off #770 (closed), /cc @mbehrle)

Tasks to perform after the merge of this improvement:

• Improve https://wiki.debian.org/DebusineDebianNet to suggest a first-time command where no upload is involved so that they can test without fearing of uploading anything to Debian.