CI: run the push workflows on master only, not on tag pushes

on: push had a paths filter but no branch restriction, so a tag push
(a release's v<version> tag) re-ran forgetest-ci and fixture-ci on the
commit master had already tested - a tag push bypasses the paths
filter. branches: [master] scopes the push trigger to the branch;
pull_request and workflow_dispatch are unchanged.

.github/workflows/fixture-ci.yml

@@ -11,6 +11,7 @@ name: fixture-ci
 
 on:
   push:
+    branches: [master]
     paths:
       - 'fixture/**'
       - '.github/workflows/fixture-ci.yml'

.github/workflows/forgetest-ci.yml

@@ -20,6 +20,7 @@ name: forgetest-ci
 
 on:
   push:
+    branches: [master]
     paths:
       - 'forgetest/**'
       - 'scripts/acceptance-gate.py'