gitlab-ci: pin windows and macos jobs to runners with matching toolsets

The toolsets available on machines hosting shell runners will evolve over time. Require the runners to have tags indicating that they have specific toolsets available. When toolsets are eventually removed from a runner, its tags can then be updated accordingly to prevent pipelines created for old commits from ever running on them.