ci/rules: make every job exist as manual in fork pipelines

In forks, every job exists, but no job is automatically run.

Should help with the problem of users clicking on that tempting "play"
button GitLab offers and that has been causing a lot of issues with
wasted resources.

Downside is, users now have to use the `bin/ci/ci_run_n_monitor.sh`
script to be able to run a bunch of jobs at once.

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25252>

.gitlab-ci.yml

@@ -195,8 +195,16 @@ include:
 .rules-anchors:
   # Pre-merge pipeline
   - &is-pre-merge '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  # Push to a branch on a fork
+  - &is-fork-push '$CI_PROJECT_NAMESPACE != "mesa" && $CI_PIPELINE_SOURCE == "push"'
 
 
+# Rules applied to every job in the pipeline
+.common-rules:
+  rules:
+    - if: *is-fork-push
+      when: manual
+
 .never-post-merge-rules:
   rules:
     - if: *is-post-merge
@@ -205,6 +213,7 @@ include:
 
 .container+build-rules:
   rules:
+    - !reference [.common-rules, rules]
     # Run when re-enabling a disabled farm, but not when disabling it
     - !reference [.disable-farm-mr-rules, rules]
     # Never run immediately after merging, as we just ran everything