fix(rules): filter gitlab jobs better

list other top-level keys and replace the patternProperties filter
with additionalProperties to prevent top-level keys from being
validated as jobs (which they will fail)

rules/gitlab-ci.yml

@@ -42,8 +42,24 @@ rules:
 
     check:
       type: object
-      patternProperties:
+      properties:
-        "^(?!stages$|\\.)":
+        after_script:
+          type: array
+        before_script:
+          type: array
+        cache:
+          type: object
+        image:
+          type: string
+        services:
+          type: array
+        stages:
+          type: array
+        types:
+          type: array
+        variables:
+          type: object
+      additionalProperties:
         type: object
         required: [script]
         properties:
@@ -59,3 +75,22 @@ rules:
             type: array
             items:
               type: string
+
+  - name: gitlab-top-level
+    desc: should only have jobs and stages at the top level scope
+    level: info
+    tags:
+      - gitlab
+      - optional
+
+    check:
+      type: object
+      not:
+        anyOf:
+          - required: [image]
+          - required: [services]
+          - required: [types]
+          - required: [before_script]
+          - required: [after_script]
+          - required: [variables]
+          - required: [cache]