It was thought that the existing SAST template rules were sufficient to
disable running SAST jobs on pipelines which weren't branch, tag or MR
ones.

This is empirically false (#147).

Add additional rules configuration which restricts mandatory jobs to MR,
branch or tag pipelines. Additionally respect the
`AST_ENABLE_MR_PIPELINES` variable to conditionally enable MR pipelines
while disabling branch pipelines if an MR is open.

fix(mandatory-jobs): disable running on non MR, branch or tag pipelines

Closes #147

See merge request !184

This reverts commit 1f9ba274.