ci: do not run tests for patched picodata on every push

These tests are quire lengthy and are useful only when we changed the
patchset.

So run them always on master, and if `certification_patches` dir
contains any changes. Otherwise use `when: manual`