CI: diff filters checking HEAD instead of master

The git diff checks the HEAD instead of the master branch. This leads to unexpected failures as described in !13 (merged) (same thing happening in !49 (merged))

We also need a way to handle the fact that only:changes seems to work relevant to the branch from which a CI job is triggered. Apparently if a user makes multiple commits that will not change files for which a pipeline has previously failed, the corresponding jobs will not run at the final commit and we end up having a successful pipeline just because some jobs were omitted. This seems to have happened in !49 (merged)