Switch from CI_COMMIT_BRANCH TO CI_COMMIT_REF_PROTECTED for tags

The background is that the CI_COMMIT_BRANCH is unset if a tag is used, so there is no way to use this one to check if the branch is the default one.

However, one can check if the branch is protected (which by default) is just the default one.