Improve docs to avoid having `rules:` result in double pipelines on merge requests

Summary

Adding rules: ... to a job makes gitlab start 2 pipelines instead of one on merge requests

Steps to reproduce

this ci configuration makes 1 pipeline:

image: docker:19.03.2

stages:
    - build

image:web:
    stage: build
    interruptible: true
    script:
        - echo hello

this one makes 2:

image: docker:19.03.2

stages:
    - build

image:web:
    stage: build
    interruptible: true
    rules:
        - when: manual
    script:
        - echo hello

the "new" pipeline have the "detached" label. but the merge request is a fast forward (no rebase needed) and both pipeline have the same commit id

Proposal

workflow:rules: allows us to solve today all ambiguity: #34756 (comment 282820625). Effectively resolving this issue. Our only follow-up is to properly document how to deal with it:

1. if you want to use rules:, always add workflow:rules:,
2. we provide a bunch of different workflow:rules: and describe their pattern,
3. we ask to gradually remove only/except from jobs.
4. if you really want to use rules: only (without workflow:rules:), then you need to add a workaround that filters out the merge-request pipelines within a job.

We should at the same time review the only/except section of the documentation and make sure that we are doing our best to drive people towards using only the new rules syntax in their pipelines.