ci: Run head.hackage jobs on upstream-testing branch rather than master

This change allows less priviledged users to trigger head.hackage jobs
because less permissions are needed to trigger jobs on the
upstream-testing branch, which is not protected.

There is a CI job which updates upstream-testing each hour to the state
of the master branch so it should always be relatively up-to-date.