ci: release jobs run on any ref, not only version tag pushes

[AndreaDiazCorreia]

.github/workflows/rust.yml runs on version tag pushes and on workflow_dispatch, but the publish and release jobs never check which ref or which event started the run.

• publish (line 127) is gated only by if: success(), so it reaches cargo publish --locked (line 137) on whatever ref the run was started from.
• release (line 142) has no if: at all. It passes github.ref_name as tag_name (line 165), which on a branch run is the branch name, so the run creates a GitHub Release named after the branch. It also does not depend on publish, so it still runs when cargo publish fails.

A manual run started on any branch therefore reaches crates.io and creates a release.

mostro had the same shape and is fixing it in MostroP2P/mostro#909. What that PR settled on, in case it is useful here:

1. Gate both jobs on the ref, the way mostro-core already does.
2. Require a push event as well: the workflow_dispatch ref selector accepts tags, not only branches, so github.ref on its own does not distinguish a tag push from a dispatch aimed at a tag.
3. Require an exact vX.Y.Z. The v*.*.* trigger is a glob, so refs like v1.2.3foo, vfoo.bar.baz and v1.2.3.4 match it too. Actions expressions have no regex, so this ends up as a small job whose output the two release jobs read through needs.

Worth keeping the build jobs reachable from workflow_dispatch: a manual run stays a way to check the cross-compilation before tagging.