ci: consider making path ignoring more robust

[ee7]

I'm creating an issue to track what I mentioned in this comment, since the failure mode just happened.

PR #254 passed checks at PR time and on main, but only because the tests workflow was skipped (the Dockerfile was not included in the list of paths for which the workflow should run). It's easy to miss that a workflow was skipped when creating or reviewing a PR, so it then caused CI failures in subsequent PRs.

I argue that it is difficult to maintain a list of paths on which a workflow should run, and more robust to maintain a list of paths on which the workflow should not run.

It is better for a workflow to run on a PR when it doesn't need to, than not run on a PR when it should.