ci: Assert where we going to push the flatpak refs

For the last two cycles we had weird configuration bugs where we ended up deploying refs to the wrong remote.

Add a python script that's readable and doesn't do regex in the hopes we can assert the deployment targets.

Backport of:

• !2730 (merged)
• !2732 (merged)