It is not clear how to use `only` keys logically joined with AND

Summary

According to our documentation, we should be able to logically join the keys in only by an AND.

However, when one of the keys is:

refs:
  - tags

, then it will run if the commit contains a tag, ignoring any other keys in only.

Steps to reproduce

1. create a project
2. use refs and changes in only:

only:
  refs:
    - tags
  changes
    - file1

3. commit, push
4. create a tag and then git push --tags
5. notice that the job is created and runs, even though there are no changes to file1

Example Project

https://gitlab.com/nelbacha/ci-only-tags-and-changes

What is the current bug behavior?

The keys are not joined logically by an AND

What is the expected correct behavior?

The keys are joined logically by an AND

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

This bug happens on GitLab.com

Results of GitLab environment info

Expand for output related to GitLab environment info

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check

(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)
(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)
(we will only investigate if the tests are passing)

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)