ci: build only on push to main, not on pull_request

Drop the pull_request:[main] trigger so the CVE scan + Docker build runs
only when changes land on main, not when a PR is opened against it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/cve-scan-docker-build.yml

@@ -3,8 +3,6 @@ name: CVE Scan & Docker Build
 on:
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
 
 env:
   REGISTRY: git.helu.ca