[backport-1.4] Restrict promote job to run only when a tag is created on a protected branch

Closes #145 (closed)

cc @satyawanj @marc.bailly1 @loic.nicolle