Use pull_request triggers primarily for workflows

Instead of relying on push triggers in general, we now use pull_request
and reserve push triggers for main and release branches.

This makes the behaviour more consistent for users contributing from
repository forks. However, we no longer have a quick-feedback loop
for development.

.github/workflows/ci-codeql.yml

@@ -3,8 +3,6 @@ name: CI-codeql
 on:
   push:
     branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
   schedule:
     - cron: '25 23 * * 2'