gha: run CodeQL scan on pull requests
gha: run CodeQL scan on pull requests

CodeQL should run on pull requests to avoid post-merge surprises.

Signed-off-by: Kazuyoshi Kato <732288c132d39c7d9231a005036e5ecd0fff1d64@amazon.com>

estesp/containerd,estesp/containerd,mikebrow/containerd,mikebrow/containerd,thaJeztah/containerd,containerd/containerd,dmcgowan/containerd,containerd/containerd,thaJeztah/containerd,dmcgowan/containerd