Port our gitlab CI to use the (not that new) rules configuration for conditional jobs rather than the (ancient and weird) only keyword.
Additionally, this is tweaked to run more conservatively, so we won't pointlessly run lint or build jobs on pushed to protected branches (e.g. master).