ci: pin follow up (#259)

- also run on PR
- fix allowlist

Author: Hofer-Julian

.github/workflows/enforce-sha.yaml

@@ -1,4 +1,7 @@
-on: push
+on:
+  push:
+    branches: [main]
+  pull_request:
 
 name: Security
 
@@ -12,4 +15,4 @@ jobs:
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@25ed13d0628a1601b4b44048e63cc4328ed03633 # v3
         with:
           allowlist: |
-            - prefix-dev/
+            prefix-dev/