feat: ignore ssh agent setup when env missing

[Steffen911]

Trying #43 again.

According to this (actions/runner#520) issue, one cannot use secrets for conditional jobs. Including the workarounds in the issue we end up with three options:

1. Add an explicit flag to indicate if a repo is public (approach in this PR). If a repo is public, we skip the SSH login. For an example see build: test ignore ssh branch tap-bing-ads#7.
2. We could try to get the public/private status from the GitHub API (it's not part of the build context). This would entail a more complicated job setup here in cue, but would remove the need for additional flags. IMO not preferable, because the default (private) is used across most repositories anyway.
3. Use the workaround mentioned in the GitHub issue:

  check-env:
      outputs:
        my-key: ${{ steps.my-key.outputs.defined }}
      steps:
          - id: my-key
            env:
                MY_KEY: ${{ secrets.MY_KEY }}
            if: "${{ env.MY_KEY != '' }}"
            run: echo "::set-output name=defined::true"

  next-job:
        needs: [check-env]
        if: needs.check-env.outputs.my-key == 'true'
        ...

This should work without additional flags and API requests, but some people already report issues and it will be complicated to integrate into our CUE setup.

IMO the explicit flag is the cleanest solution and doesn't require any changes to the existing setups. Let me know what you think.