Your team hosts application source code in a self-managed GitLab instance running inside your corporate network, which is not one of Cloud Build's natively integrated SCM providers. You want each merge to the main branch to automatically start a Cloud Build pipeline. The GitLab server can make outbound HTTPS calls to Google Cloud APIs. Which approach lets you trigger the build while protecting the trigger endpoint from unauthorized invocation?