gitlab-ci: Move 'analysis' stage to a more "mainstream" position

I suppose the intention of having this stage at the end was to make clear: no
job depends on it. However, this place is not common or ideal but one of two:
1) before building, which is more linear; or 2) after building (the choosen)
even if this isn't dynamic analysis (tests), since they are both related and
some compilers and build systems do static analysis. Anyway, not after dist.

The new place is a bit  more clear to devs used at "build, test, deploy" praxis
and maybe will be now better noticed by the existing devs before distributing.
It's not perfect, since I explained above that there are two places/approaches.

Obviously, the stage continues to be OPTIONAL to pass, nothing was changed.

---

Also, dropped the deprecated "only:" (in clang-format job) in favor of "rules:"
and made the artifacts paths of clang-format and cppcheck more consistent.

.gitlab-ci.yml

@@ -21,17 +21,17 @@
 # - GIMP_CI_MSYS2_WIN_AARCH64: trigger the native MSYS2 build for Win Aarch64.
 # - GIMP_CI_MSYS2_WIN64: trigger the native MSYS2 build for Win 64-bit.
 # - GIMP_CI_MSYS2_WIN32: trigger the native MSYS2 build for Win 32-bit.
+# - GIMP_CI_CPPCHECK: trigger cppcheck static analysis.
 # - GIMP_CI_SOURCES: trigger the Debian Clang build and the source tarball job.
 # - GIMP_CI_FLATPAK: trigger the flatpak build and publishing.
 # - GIMP_CI_WIN_INSTALLER: trigger all native MSYS2 builds then creates Inno Windows installer.
-# - GIMP_CI_CPPCHECK: trigger cppcheck static analysis.
 
 stages:
   - prepare
   - dependencies
   - gimp
-  - distribution
   - analysis
+  - distribution
 
 
 # Common pipelines behavior
@@ -620,6 +620,50 @@ gimp-win-x86:
     expire_in: 1 day
 
 
+## Analysis ##
+
+clang-format:
+  extends: .default
+  rules:
+    # On merge requests only.
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  needs: []
+  stage: analysis
+  cache: []
+  script:
+    - apt-get update
+    - apt-get install -y clang-format
+                         git
+    - .gitlab/run_style_check_diff.sh
+  allow_failure: true
+  artifacts:
+    when: on_failure
+    paths:
+      - fetch_upstream.log
+      - fetch_origin.log
+    expire_in: 1 week
+
+cppcheck:
+  extends: .default
+  rules:
+    # Custom builds only (web GUI, API or schedules).
+    - if: '$GIMP_CI_CPPCHECK != null'
+  needs: []
+  stage: analysis
+  cache: []
+  script:
+    - apt-get update
+    - apt-get install -y cppcheck
+    - cppcheck -q -j8 --enable=all --force --output-file=cppcheck.xml --xml --xml-version=2
+        -i _build-x64 -i _build-x86 -i _deps -i _install-x64 -i _install-x86 -i .local -i .cache .
+    - mkdir report
+    - cppcheck-htmlreport --source-dir=. --title=gimp --file=cppcheck.xml --report-dir=report
+  artifacts:
+    paths:
+      - report/
+    expire_in: 1 week
+
+
 ## Ready-to-distribute ##
 
 sources-debian:
@@ -736,44 +780,3 @@ dist-installer-weekly:
       - build/windows/installer/_Output/
       - installer.log
     expire_in: 1 week
-
-
-## Analysis ##
-
-clang-format:
-  extends: .default
-  only:
-    - merge_requests
-  needs: []
-  stage: analysis
-  cache: []
-  script:
-    - apt-get update
-    - apt-get install -y clang-format
-                         git
-    - .gitlab/run_style_check_diff.sh
-  allow_failure: true
-  artifacts:
-    when: on_failure
-    paths: ['fetch_upstream.log', 'fetch_origin.log']
-    expire_in: 1 week
-
-cppcheck:
-  extends: .default
-  rules:
-    # Custom builds only (web GUI, API or schedules).
-    - if: '$GIMP_CI_CPPCHECK != null'
-  needs: []
-  stage: analysis
-  cache: []
-  script:
-    - apt-get update
-    - apt-get install -y cppcheck
-    - cppcheck -q -j8 --enable=all --force --output-file=cppcheck.xml --xml --xml-version=2
-        -i _build-x64 -i _build-x86 -i _deps -i _install-x64 -i _install-x86 -i .local -i .cache .
-    - mkdir report
-    - cppcheck-htmlreport --source-dir=. --title=gimp --file=cppcheck.xml --report-dir=report
-  artifacts:
-    paths:
-      - report
-    expire_in: 1 week