Document how often CI_JOB_TOKEN is regenerated
From me reading around (and maybe I missed something) it is unclear how often CI_JOB_TOKENs are regenerated. So I am consider passing them using docker build --build-arg
into a Docker image. Sadly, that token can be later on retrieved from a published image. So if token is generated for each job new and old tokens cannot be reused then this approach is OK. But if they are reused for more than one job or stick around, then this is problematic.