WIP: Switch qa templates to rules (round 2)

What does this MR do?

Round 2 of !117 (merged), which was reverted in !119 (merged)

Switches all QA templates to rules syntax. Simplify inheritance of only/except conditions by centralizing rules into inheritor jobs. Limit update-qa jobs to branches only.

• Category:SAST test:
• ~"Category:Dependency Scanning" test:
• ~"Category:License Compliance" test:
• Category:Container Scanning test:

Key Changes from !117 (merged)

1. include workflow:rules limiting executions to branches. this more accurately reflects the former only/except execution mode
2. set when: manual in all cases for update-qa-** jobs**

This changes what I believe to be the root cause of the previous issue. In the last attempt, we used a rule condition meant to set the job for manual execution in the presence of $CI_COMMIT_BRANCH. The expectation was that this would always be true, however the action of opening an MR triggers a Merge Request pipeline, for which this was not true, causing the when condition to be set to on_success instead of manual. EDIT: This is incorrect, see !122 (comment 357593588) for true reason

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

• Tests added for this feature/bug