CI: use contexts to allow manual approval of running system tests

[tswast]

https://circleci.com/docs/2.0/contexts/#approving-jobs-that-use-restricted-contexts

This new approval job feature should allow code to be reviewed before running system tests from a fork (to prevent secrets from being leaked)