ci: Replace only/except with rules

only/except keywords where deperecated in favor of rules.

Since we started using GNOME/gnome-shell!1492 it introduced
a second pipeline being run for each commit.

Detached pipelines are the only way to access CI_MERGE_REQUEST_*
variables, and if we disable normal pipelines you will need to
create wip/spam MRs in order to run the tests.

This reworked rules makes it so, the normal pipeline needs manual
interaction to be started, and the detached/MR pipleines is always
run.

Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1503>

.gitlab-ci.yml

@@ -31,11 +31,19 @@ variables:
 
 image: registry.gitlab.gnome.org/gnome/mutter/fedora/33:2020-11-20.1
 
-.only_default: &only_default
-    only:
-        - branches
-        - tags
-        - merge_requests
+workflow:
+    rules:
+        - if: '$CI_MERGE_REQUEST_IID'
+        - if: '$CI_COMMIT_TAG'
+        - if: '$CI_COMMIT_BRANCH'
+
+.pipeline_guard: &pipeline_guard
+    rules:
+        - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+        - if: '$CI_COMMIT_TAG'
+        - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+        - if: '$CI_COMMIT_BRANCH =~ /^gnome-[0-9-]+$/'
+        - when: 'manual'
 
 .gnome-shell.fedora:33:
     variables:
@@ -73,7 +81,7 @@ check_commit_log:
         GIT_DEPTH: "100"
     script:
         - ./.gitlab-ci/check-commit-log.sh
-    <<: *only_default
+    <<: *pipeline_guard
     artifacts:
         expire_in: 1 week
         paths:
@@ -92,13 +100,13 @@ check-merge-request:
           else
             echo "Not a merge request" ;
           fi
+    <<: *pipeline_guard
     artifacts:
         expire_in: 1 week
         paths:
             - check-merge-request-report.xml
         reports:
             junit: check-merge-request-report.xml
-    <<: *only_default
 
 build-fedora-container:
     extends: