Do not allow publishing from other than master
This amends the fix at 807a194a. In this case we do want these clauses to happen together so that we only publish packages to PyPi from master.
What this also fixes is the manual approval. Because we had two if
statements, two separate pipelines got executed, one when merging to
master and the other because there was a tag. Since the former didn't
have a when: manual
it published the 0.0.2 without our intervention.
It was the latter pipeline that asked for our approval and it then failed because the package was already uploaded to PyPi.