Add pull_request trigger to CodeQL workflow

Re-enables CodeQL scanning on PRs. This requires the repo to be
public so that the Actions runner can checkout the code.

Author: lzongren

.github/workflows/codeql.yml

@@ -3,6 +3,8 @@ name: CodeQL
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
   schedule:
     - cron: '0 6 * * 1'  # Weekly Monday 6am UTC