Limit post-push pipelines for autorebased branches

Limit post-push pipelines for autorebased branches

Current CI job triggering rules cause a full pipeline to be started
after every push to security-* branches.  In this context, "push" means
"branch update", which covers both "git push" invocations and merging a
merge request.  Meanwhile, running a test pipeline is only desired after
a rebase; if a branch is fast-forwarded, it means that a merge request
has been merged into it and a pipeline should have already been run for
that merge request itself.  Limit resource use by only triggering
pipelines for security-* branches when they are pushed to with a "magic"
CI variable that is only set in autorebase jobs.  Leave all the other
triggering rules (for scheduled/manual pipelines) intact.