ci: update scorecard to only run on push and PR to main

Author: FlysonBot

.github/workflows/ossf_scorecard.yml

@@ -2,7 +2,10 @@ name: OSSF Scorecard
 on:
   push:
     branches:
-      - "*"  # avoid running on tag push (unsupported by scorecard)
+      - main
+  pull_request:
+    branches:
+      - main
   workflow_dispatch:
 
 permissions: read-all