Use pull-push cache policy only when needed

Only the prepare:* jobs need to write to the cache, so make the cache policy pull by default.

Closes #660 (closed)