Re-define default only except policy

What does this MR do?

This fixes a problem of default only/except policy not being applied correctly if an only: is defined, thus our default policy being overwritten.

What are the relevant issue numbers?

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/55099

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the style guides
• Security reports checked/validated by reviewer