cve-pipeline: allow specifying a private fork of ceph.git

cve-pipeline: allow specifying a private fork of ceph.git

Convert CEPH_REPO from a single-choice dropdown to a free-form string
parameter (defaulting to ceph-private.git as before) in both cve-pipeline
and cve-source-dist so CVE fixes can be built from GitHub Security
Advisory temporary private forks (e.g.
git@github.com:ceph/ceph-ghsa-xxxx-xxxx-xxxx.git).

The change to cve-source-dist is required because ceph-dev-pipeline's
Jenkinsfile forwards CEPH_REPO to the setup job as a string parameter,
and a choice parameter would reject values not in its list.

The ceph-jenkins GitHub account must be added as a collaborator on the
security advisory for its fork to be cloneable.

Signed-off-by: David Galloway <david.galloway@ibm.com>