ci: switch to rules

`only` has been deprecated and gitlab recommends to use rules instead,
which are more flexible.

Add a global workflow and change the `only` specifications to `rules`.