ci: build, sign and verify images on MR and tag pipelines only

What does this MR do and why?

Image-touching jobs (build, sign, SBOM, attest, verify, scan, both FIPS smoke jobs) now run only on merge request pipelines and tag pipelines. The catalog container component pushes latest* on every default-branch build, so the first docs fix merged to main would have rebuilt all six images and moved latest off the release digests. Merges here are fast-forward with a green pipeline required, so the MR pipeline already proves the exact tree that lands on main; a main rebuild added nothing but that risk and twelve 2xlarge build jobs per docs commit.

References

• Component behaviour: gitlab-com/public-sector/pipeline templates/container/template.yml lines 109-115 at v6.2.1, latest* pushed on the default branch or a tag.
• Each component's job_rules input is overridden through one YAML anchor; the release component is tag-only already.

Variants affected

All six, in when they build, not in what they contain.

Test plan

• glab ci lint: valid.
• Dry-run lint as a main pipeline: code_quality dependency-scanning-profile-0 dockerfile-lint pages secret_detection vale, no image jobs.
• Dry-run lint as tag v1.25.19: 38 jobs, the full image set plus both smoke jobs and the release jobs. Container scanning now also runs on tag pipelines, where it was previously excluded.
• This MR's own pipeline builds, signs and verifies all six variants as before.
• After merge, the main pipeline shows no image jobs and every latest* digest still equals its v1.25.19* digest.