ci: Use "when: on_success" in job rules
Instead of "when: always". The latter would result in jobs running even after a dependency job failed, which would inevitably result in the dependent job failing as well. See !2628 (comment 1758824) for an example.