ci: build: only persist disk images for protected branches

[hnez]

Right now this mostly means not persisting runs that are on the dependabot/… branches but not triggered by dependabot.

• This does not affect jobs triggered by dependabot, because they always behave like pull requests from a forked repository.

• This affects dependabot/… branches even if there is a * branch protection rule configured for the repository, because

  Because GitHub uses the File::FNM_PATHNAME flag for the File.fnmatch syntax, the wildcard does not match directory separators (/). For example, qa/ will match all branches beginning with qa/ and containing a single slash, but will not match qa/foo/bar.

  Source