Change CI to use 'rules' not 'only/except'

This is recommended by gitlab, as the `only/except` clauses are
superseded by `rules`.

Also hoping to prevent publishing the Python package to Nexus when
not tagged.  This has happened recently.

pip `--extra-index-url` no longer needed as container's `pip.conf`
includes this.