ci: don't run pipelines in forks
Currently our CI setup has a downside: for each push on a merge request, two pipelines are triggered. The first is triggered in the context of the forked repository, and the second is triggered in the context of the MR in the parent repository.
Replace the workflow rules with the ones in the official docs 1, so that a branch pipeline isn't triggered when a MR exists for that branch.
Fixes: fbf7fc35 ("ci: use detached CI pipelines")