Backend: [CI] reference tags can not be used in `rules` under `include` blocks.

Summary

When using a reference tag inside rules under an include block, GitLab errors out with the following backtrace

NoMethodError: undefined method `map' for #<Gitlab::Ci::Config::Yaml::Tags::Reference:0x00007f3651504ec8>
Did you mean?  tap

lib/gitlab/ci/build/rules/rule.rb:10:in `fabricate_list'
lib/gitlab/ci/config/external/rules.rb:9:in `initialize'
lib/gitlab/ci/config/external/mapper.rb:64:in `new'
lib/gitlab/ci/config/external/mapper.rb:64:in `verify_rules'
lib/gitlab/ci/config/external/mapper.rb:36:in `each'
lib/gitlab/ci/config/external/mapper.rb:36:in `filter_map'
lib/gitlab/ci/config/external/mapper.rb:36:in `process'
lib/gitlab/ci/config/external/processor.rb:12:in `initialize'
lib/gitlab/ci/config.rb:97:in `new'
lib/gitlab/ci/config.rb:97:in `build_config'
ee/lib/ee/gitlab/ci/config_ee.rb:18:in `build_config'
lib/gitlab/ci/config.rb:84:in `expand_config'
lib/gitlab/ci/config.rb:29:in `initialize'
lib/gitlab/ci/yaml_processor.rb:23:in `new'
lib/gitlab/ci/yaml_processor.rb:23:in `execute'
lib/gitlab/ci/lint.rb:57:in `static_validation'
lib/gitlab/ci/lint.rb:31:in `validate'
app/controllers/projects/ci/lints_controller.rb:19:in `create'
ee/lib/gitlab/ip_address_state.rb:10:in `with'
ee/app/controllers/ee/application_controller.rb:44:in `set_current_ip_address'
app/controllers/application_controller.rb:489:in `set_current_admin'
lib/gitlab/session.rb:11:in `with_session'
app/controllers/application_controller.rb:480:in `set_session_storage'
lib/gitlab/i18n.rb:105:in `with_locale'
lib/gitlab/i18n.rb:111:in `with_user_locale'
app/controllers/application_controller.rb:474:in `set_locale'
app/controllers/application_controller.rb:468:in `set_current_context'
ee/lib/omni_auth/strategies/group_saml.rb:41:in `other_phase'
lib/gitlab/metrics/elasticsearch_rack_middleware.rb:16:in `call'
lib/gitlab/middleware/rails_queue_duration.rb:33:in `call'
lib/gitlab/middleware/speedscope.rb:13:in `call'
lib/gitlab/request_profiler/middleware.rb:17:in `call'
lib/gitlab/database/load_balancing/rack_middleware.rb:38:in `call'
lib/gitlab/metrics/rack_middleware.rb:16:in `block in call'
lib/gitlab/metrics/web_transaction.rb:21:in `run'
lib/gitlab/metrics/rack_middleware.rb:16:in `call'
lib/gitlab/jira/middleware.rb:19:in `call'
lib/gitlab/middleware/go.rb:20:in `call'
lib/gitlab/etag_caching/middleware.rb:21:in `call'
lib/gitlab/middleware/multipart.rb:172:in `call'
lib/gitlab/middleware/read_only/controller.rb:50:in `call'
lib/gitlab/middleware/read_only.rb:18:in `call'
lib/gitlab/middleware/same_site_cookies.rb:27:in `call'
lib/gitlab/middleware/handle_malformed_strings.rb:21:in `call'
lib/gitlab/middleware/basic_health_check.rb:25:in `call'
lib/gitlab/middleware/handle_ip_spoof_attack_error.rb:25:in `call'
lib/gitlab/middleware/request_context.rb:21:in `call'
config/initializers/fix_local_cache_middleware.rb:11:in `call'
lib/gitlab/middleware/rack_multipart_tempfile_factory.rb:19:in `call'
lib/gitlab/middleware/sidekiq_web_static.rb:20:in `call'
lib/gitlab/metrics/requests_rack_middleware.rb:75:in `call'
lib/gitlab/middleware/release_env.rb:12:in `call'

Steps to reproduce

Try the following CI config

.if_canonical_mirror: &if_canonical_mirror
  if: '$CI_PROJECT_PATH == "balasankarc/samplerepo"'

include:
  - template: Dependency-Scanning.gitlab-ci.yml
    rules:
      - !reference [.if_canonical_mirror]
  - template: Security/Secret-Detection.gitlab-ci.yml
    rules:
      - !reference [.if_canonical_mirror]

job1:
  script:
    - echo 'Hello world'

What is the current bug behavior?

GitLab errors out

What is the expected correct behavior?

CI works as expected

User Impact

Users can't reference tags in rules under include blocks as the description notes.

Edited by Mark Nuzzo