Stop using `rules:` in pipelines

The original issue was that using rules: if: ... for only some pipelines (commit-verify) would

a) cause those pipelines to show as detached, and

b) allow hitting 'merge' before all pipelines succeeded: only the pipelines with rules: would be required to succeed.

A possible workaround I came up with was to use rules: unconditionally for all pipelines. There were two variants of this:

1. Use rules to run other pipelines unconditionally. This didn't work because it no longer ran commit-verify.
2. Use rules to run other pipelines on all merge requests. This was decided to be not worth the benefit of using rules at all for several reasons:

• It would show pipeline failures as belonging to the upstream repo, making it harder to find failures on master
• It would mean you had to make an MR even if you just wanted to see if the pipeline would succeed.
• It would make all pipelines show up as 'detached', which is confusing and unnecessary.

Instead this reverts to the old behavior of hard-coding branches and the URLs of upstream repositories.