There is a logical OR between the two things, not an AND. You should find that pushing on non-master branches will not build unless they are tagged in the way you are expecting.
I know this has come up in the forum before. This thread is a bit miserable, but at least it points to a feature suggestion.
You could do some filtering at the shell level - that is not ideal as the job will always run, but it would work. Use a Bash conditional to not do your main build work unless the two conditions are satisfied.
One very hacky solution I’m looking at is having one of the filters on the job that I want to AND, and having another filter on one of its required jobs. Won’t work for every workflow and is pretty awful, but might be a workaround.