CI: fix the ABI check job, it was using the wrong HEAD

The ABI job git cloned from upstream and then compared HEAD with the last ABI break. Problem though: the HEAD was origin/main, not the actual HEAD from the merge request.

Fix this by adding upstream as a remote and fetching from it. And while we're there update to the last ABI break commit sha and move the abicheck bits into before_script.

Note that the remote has the CI job ID appended, this avoids conflicts when the git repo is re-used betweenn jobs and the upstream remote already exists.