[CI] Ensure 'issue-bot' job is only run 'on_failure' for tags and stable branches

What

Fixes the 'rules' for the issue-bot CI job, ensuring it is only included on failure for tags and stable branches.

Why

Issues like #458 (closed) were created on stable branches and tags, even when the pipeline for those refs passed without any failures.

Closes #459 (closed)