fix: separate safe permission check job and ci job

[junpuf]

• PR Permission Gate workflow will be executed using base branch instead of using PR branch, which prevents malicious user from modifying the PR Permission Gate workflow itself to bypass the check.
• Makes PR Permission Gate workflow a required workflow using branch protection rule.
• CI workflow now react directly to pull-request event.