Cherry-pick 'ci: add gitlab-ultimate scanner' into release/0.25

Original MR: !225 (merged)

This MR is a Cherry Pick into a Release Branch.

After the release branch is first created, any subsequent changes use this process to update the release (often resulting in a new patch tag) without incorporating all changes in the default branch. These MRs must be approved by the PMC before they are merged, since they alter the scope of the release. To see more details about the change itself, look at the Original MR listed above.