ci: do not run tests for patched picodata on every push

Summary

• ci: do not run tests for patched picodata on every push

These tests are quire lengthy and are useful only when we changed the patchset.

So run them always on master, and if certification_patches dir contains any changes. Otherwise use when: manual

• Cherry-pick to: none
• Docs follow-up: not necessary