fix(mandatory-jobs): disable running on non MR, branch or tag pipelines

It was thought that the existing SAST template rules were sufficient to disable running SAST jobs on pipelines which weren't branch, tag or MR ones.

This is empirically false (#147 (closed)).

Add additional rules configuration which restricts mandatory jobs to MR, branch or tag pipelines. Additionally respect the AST_ENABLE_MR_PIPELINES variable to conditionally enable MR pipelines while disabling branch pipelines if an MR is open.

Closes #147 (closed)