Add `excludes` keyword to batch spec schema

Created by: courier-new

Currently the only way to exclude individual workspaces from the set resolved for running a batch spec against is by modifying the repositoriesMatchingQuery with -repo:<repo-to-exclude>, which can quickly muddy up a complex search query and is not the most flexible way of expressing exclusions (for example for monorepos, it's not possible to exclude a specific repo path this way).

The better solution would be to build exclusions into the batch spec schema, using the same patterns as on.

This could fit in a couple of different ways. For example, it could just be another child of on with the excludes keyword to distinguish it:

on:
  - repositoriesMatchingQuery: guess-who type:repo
  - repository: github.com/sourcegraph/hidden-laser
  - excludes:
    - repository: github.com/sourcegraph/archived-thing

Alternatively, it could be included as another property of repositoriesMatchingQuery itself:

on:
  - repositoriesMatchingQuery: guess-who type:repo
    excludes:
    - repository: github.com/sourcegraph/archived-thing
  - repository: github.com/sourcegraph/hidden-laser

The keyword could also be called except.