Do not create CI scan job when CI image is not built

[mitchellhenke]

🛠 Summary of changes

This PR fixes a bug in #9231 where the build-ci-image is not added to the pipeline but the ecr-scan-ci is in the pipeline and depends on it. There is no built-in functionality to not run a job if it depends on a job that is not being run. This PR attempts to fix it by using the same rules for both jobs.

Unable to create pipeline
  'ecr-scan-ci' job needs 'build-ci-image' job, but 'build-ci-image' is not in any previous stage

[timothy-spencer]

Oooh, I like this.

[timothy-spencer]

Another way to solve this is to not have dependencies on jobs, and just rely on stages to ensure that what is required gets done before it gets to this job. It's a bit less fast, but it's easier when the pipeline is somewhat complex like we have.

[mitchellhenke]

Another way to solve this is to not have dependencies on jobs, and just rely on stages to ensure that what is required gets done before it gets to this job. It's a bit less fast, but it's easier when the pipeline is somewhat complex like we have.

I couldn't quite figure out a way to "group" the two jobs together and share a set of rules for running (in a distinct stage or otherwise). Would very much like to simplify, so very much open to suggestions!