use push-only token (#730)

Author: e3b0c442

.github/workflows/pr-license-scan.yaml

@@ -6,15 +6,14 @@ on:
 jobs:
   fossa-scan:
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - uses: actions/checkout@v3
       - name: "Run FOSSA Analyze" 
         uses: fossas/fossa-action@main
         with:
-          api-key: ${{ secrets.FOSSA_API_KEY }}
+          api-key: cf2d0196f5b5bb2fd245c559af8766d8 # push-only token, safe to expose
       - name: "Run FOSSA Test"
         uses: fossas/fossa-action@main
         with:
-          api-key: ${{ secrets.FOSSA_API_KEY }}
+          api-key: cf2d0196f5b5bb2fd245c559af8766d8 # push-only token, safe to expose
           run-tests: true