Make --forbid-only (but not --forbid-pending) default in CI

[ScottFreeCode]

Eventually let's make --forbid-only the default and use --no-forbid-only to disable it. Lots of CI will get safer for free!

(Pending, on the other hand, isn't so dangerous to begin with and has more long-term use-cases. It'll be inconsistent, but let's leave pending as-is.)

[boneskull]

Actually, this is fine if we make --forbid-only the default if the CI environment var is present.

[parksb]

I agree with making --forbid-only the default on CI environment. Can I take this issue?

[outsideris]

@parksb Yes, you can.

[github-actions]

This issue hasn't had any recent activity, and I'm labeling it stale. Remove the label or comment or this issue will be closed in 14 days. Thanks for contributing to Mocha!

[github-actions]

This issue hasn't had any recent activity, and I'm labeling it stale. Remove the label or comment or this issue will be closed in 14 days. Thanks for contributing to Mocha!