Drop CI builds triggered by blocked user

When a user is blocked, typically `Ci::DropPipelineService` will
cancel the builds. However, there's a chance that this service doesn't
pick up all the cancelable builds at the time it is run. To ensure
that builds aren't actually run for blocked user, we add it to a
precondition before we assign a runner.

Changelog: fixed

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/351294

app/services/ci/register_job_service.rb

@@ -271,7 +271,8 @@ module Ci
         runner_unsupported: -> (build, params) { !build.supported_runner?(params.dig(:info, :features)) },
         archived_failure: -> (build, _) { build.archived? },
         project_deleted: -> (build, _) { build.project.pending_delete? },
-        builds_disabled: -> (build, _) { !build.project.builds_enabled? }
+        builds_disabled: -> (build, _) { !build.project.builds_enabled? },
+        user_blocked: -> (build, _) { build.user&.blocked? }
       }
     end
   end

spec/services/ci/register_job_service_spec.rb

@@ -103,6 +103,20 @@ module Ci
             pending_job.create_queuing_entry!
           end
 
+          context 'when build owner has been blocked' do
+            let(:user) { create(:user, :blocked) }
+
+            before do
+              pending_job.update!(user: user)
+            end
+
+            it 'does not pick the build and drops the build' do
+              expect(execute(shared_runner)).to be_falsey
+
+              expect(pending_job.reload).to be_user_blocked
+            end
+          end
+
           context 'for multiple builds' do
             let!(:project2) { create :project, shared_runners_enabled: true }
             let!(:pipeline2) { create :ci_pipeline, project: project2 }