fix(ci): allow OWASP scanner on fork pull requests

[Mondotrasho]

Summary

• change the OWASP scanner trigger from pull_request_target to pull_request
• only run it for PRs targeting main
• skip the PR comment on fork PRs where GitHub only gives the workflow a read-only token
• make sure a failed comment does not fail the actual scan

Reason

This is to fix the issue that came up on #341 where the OWASP workflow could not safely check out code from a fork PR. The scan itself still runs and can pass/fail normally, it just avoids trying to write a comment when GitHub does not allow it.

[Mondotrasho]

Note: this PR is coming from my fork because I do not have permission to push a branch directly to the Redback repository.

The existing OWASP check on this PR is also expected to fail for the same reason this PR exists. Until this change is merged, GitHub is still running the current pull_request_target version of the workflow from main, which cannot safely check out the fork PR.

Once this is merged, future fork PRs should run the scanner using the new pull_request workflow instead.