ci: run CodeQL action only on PRs against master
ci: run CodeQL action only on PRs against master

This fixes the following reported issue [1]:

    1 issue was detected with this workflow: Please make sure that every
    branch in on.pull_request is also in on.push so that Code Scanning
    can compare pull requests against the state of the base branch.

[1] https://github.com/cilium/cilium/actions/runs/1591471691

Note that the release branches have their own version of this workflow
and on.{pull_request,push}.branches need to be changed accordingly.

Signed-off-by: Tobias Klauser <059b8b880f8441509ec8a65b50b4c6ae74ebea76@cilium.io>

cilium/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium