[9.18] fix: ci: Fix triggering rules for the "publish-cleanup" job

The "publish-cleanup" tag pipeline job is currently created for all
security releases, including BIND -S releases, but it depends on the
"publish" job, which is only created for open source releases.  This
breaks CI configuration for BIND -S tags, preventing pipelines from
getting created for such tags altogether.  Fix by only creating the
"publish-cleanup" job in tag pipelines for open source security
releases.

Backport of MR !11992

Merge branch 'backport-michal/fix-triggering-rules-for-the-publish-cleanup-job-9.18' into 'bind-9.18'

See merge request isc-projects/bind9!11994