building only on approval saves us some cpu - do not merge

[Sybrand]

Ideally images are buildable before merging - but building on every commit to a PR is too expensive.

What we do now, is wait until a PR is approved before building it.

This way branch rules can be kept in place (must be built before merging) and don't waste cycles building on each commit.

[okumujustine]

Looked at this even though it's assigned to @zenenock, it looks good.

[Sybrand]

Turns out this isn't as easy as I had hoped.

pull_request_review:
      types: [submitted]

Only works for you on the approve event, you can't access github.event.review.state on any push after the approval. If we enforced that approval is required on a push after approval then it would be ok - but we don't want that kind of bureaucracy.

Also - the reference github.head_ref || github.ref_name is slightly different on an approval event.