ci: enable docker image promotion on MR pipelines
Promote stage previously only ran on main, release/*, and tags. MR pipelines built + scanned images in tmp/ namespace but never promoted them to deployable tags.
Changes:
- promote_template: detect MR pipeline and use mr-- source tag (was hardcoded to pending-)
- Add merge_request_event rule to all 16 promote jobs with same paths as corresponding build jobs