ci: Fix broken macOS jobs on forks of Gitaly

We have recently started to automatically run macOS jobs when changes get merged to the default branch. This has broken CI jobs on our security fork of Gitaly because it ain't got the macOS runner available.

We already have the same issue for our FIPS jobs and thus skip them when running in a fork. So let's propagate this rule into our shared rules for jobs that are only supposed to run when something hits the default branch.