misc: prevent locking all jobs (#36215)

.first() does list(qs)[:1] which will select all target jobs,
we must add a LIMIT 1 before .first() to lock only the job we are
looking for. Ordering is necessary as .first() will do an
.order_by('pk') on an unordered queryset to get a deterministic result
in all cases and ordering a sliced queryset is not possible.

passerelle/base/models.py

@@ -501,12 +501,13 @@ class BaseResource(models.Model):
         skipped_jobs = []
         while True:
             with transaction.atomic():
-                # lock a job
+                # lock a runnable job
                 job = self.jobs_set().exclude(
                         pk__in=skipped_jobs
                         ).filter(
                         status='registered'
-                        ).select_for_update(**skip_locked).first()
+                        ).select_for_update(**skip_locked
+                        ).order_by('pk')[:1].first()
                 if not job:
                     break
                 job.status = 'running'