CI: port to rules
Port our gitlab CI to use the (not that new) rules configuration for conditional jobs rather than the (ancient and weird) only
keyword.
Additionally, this is tweaked to run more conservatively, so we won't pointlessly run lint or build jobs on pushed to protected branches (e.g. master).