ci: skip image jobs on a docs-only MR pipeline

What this does

The image jobs (build, sign, sbom, attest, scan, verify, FIPS smoke) already run only on MR and tag pipelines. But every MR ran all twelve even for a README or site change: about 113 CI minutes and 18 registry tags per docs MR. We add a rules:changes gate to the MR arm of the shared .release-only-rules anchor. Those jobs now run on an MR pipeline only when a Dockerfile, .gitlab-ci.yml, scripts/, .hadolint.yaml, or go-overrides.txt changed. The tag arm keeps no changes: clause, because tag pipelines have no push event and changes: would evaluate true there anyway. A release still signs every variant, and the default branch matches neither arm and runs zero image jobs.

Verification

glab ci lint passes. GitLab's rules:changes docs confirm MR pipelines compare against the target branch by default, so compare_to is not needed.

What to check

This MR touches .gitlab-ci.yml, so its own pipeline still builds all six variants. A follow-up docs-only MR is the real test: container-build-*, container-sign-*, container-sbom-*, container-attest-*, container-verify-*, container_scanning, fips-smoke, and fips-only-smoke should all be absent there.