github-actions: limit push event to official branches

This should prevent:

• double CI runs when pushing to PR branch on main repo (due to "push" and "pull_request" events both firing)
• CI runs for unpublished branches on forks with actions enabled

But still allow:

• CI runs for PRs against official branches (drafts included)
• CI runs for pushes directly to official branches

If you want a CI run for your branch, create a PR! You could also
enable actions on your fork, but this should not be necessary.

Fixes #4922