gen_ci: Rules rework

In particular we now distinguish between whether we are dealing with a
Nightly/Release pipeline (which labels don't matter for) and a validate
pipeline where labels do matter.

The overall goal here is to allow a disjunction of labels for validate
pipelines, for example,

> Run a job if we have the full-ci label or test-primops label

Therefore the "ValidateOnly" rules are treated as a set of disjunctions
rather than conjunctions like before.

What this means in particular is that if we want to ONLY run a job if a
label is set, for example, "FreeBSD" label then we have to override the
whole label set.

Fixes #23772