BUG: don't warn on secrets in pull_request

[laurentsimon]

https://securitylab.github.com/research/github-actions-preventing-pwn-requests/:

Due to the dangers inherent to automatic processing of PRs, GitHub’s standard pull_request workflow trigger by default prevents write permissions and secrets access to the target repository.

We're looking for secrets in pull_request triggers, but should not.

Thanks @jeffmendoza and @sethvargo for flagging