Update CI to only run release pipelines manually.

In order to run container scanning regularly, we need to be able to trigger scans on nightly builds. But we likely don't want these builds pushing new final images to the registry.

Let update the CI so:

• The main branch pipeline is also a non-release pipeline like the MR pipeline
• Either decide to use our own git tags, or add a manual trigger job to the main pipeline that allows us to trigger a release pipeline.