CI: don't block the pipeline while waiting for a manual job (#555)

* CI: don't block the pipeline while waiting for a manual job

* CI: ensure 'change' rule behaves appropriately

When used in a new branch, `changes` always evaluates to true in the
absence of a `compare_to` clause.
This caused all our branch pipelines to happily run the build_ci_image
which hide the blocked pipeline issue when this job is setup as manual.

.gitlab-ci.yml

@@ -136,8 +136,12 @@ build_ci_image:
       --push \
       .
   rules:
-    - changes: ["ci/Dockerfile"]
+    - changes:
+        paths:
+          - "ci/Dockerfile"
+        compare_to: 'main'
     - when: manual
+      allow_failure: true
 
 build_deb_x64:
   extends: [.build, .x64]