ci: Use `only` clauses everywhere

Otherwise GitLab will detach jobs from the pipeline.

To limit the amount of work done by the macOS job, we run the build only on branches on the project repository.