Use pull_request trigger for vulncheck workflow

[ewanharris]

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

The action we use references github.sha which in pull_request_target points to the sha of the target branch, so a PR wont ever be scanned. By using pull_request we get the correct sha and their documentation appears to reference this so I can only assume that the sarif upload feature works as expected.

🔧 Changes

📚 References

🔬 Testing

[ewanharris]

Docker run args are pointing at the correct ref and the upload worked so this should be good GITHUB_REF=refs/pull/223/merge -e GITHUB_SHA=25201ef407ac50d7a6ec724cc6367ad26c32f056

(I think the two govulncheck / scan runs is just an artifact of going from pull_request_target to pull_request