feat(github-runners): allow public repositories and refuse pull request jobs by default

The runner group was limited to private repositories, so jobs from
public repositories never got a runner: Coolify still started a runner
for each matching job, which then waited idle until its timeout.

The runner group now allows every repository of the organization,
public ones too; existing private groups are updated. GitHub gives a
runner any queued job with matching labels, so pull request jobs are
refused inside the runner: a job-started hook fails jobs from
pull_request, pull_request_target and review events before any step
runs, and fails closed when the event is unknown. A new runner setting,
off by default, allows pull request jobs; the settings page then warns
to require approval for fork pull request workflows on GitHub.

app/Models/GithubRunnerConfig.php

@@ -20,6 +20,7 @@ class GithubRunnerConfig extends BaseModel
         'labels',
         'is_enabled',
         'is_dedicated',
+        'allow_pull_requests',
         'max_runners',
         'docker_mode',
         'runner_image',
@@ -36,6 +37,7 @@ class GithubRunnerConfig extends BaseModel
             'labels' => 'array',
             'is_enabled' => 'boolean',
             'is_dedicated' => 'boolean',
+            'allow_pull_requests' => 'boolean',
             'max_runners' => 'integer',
             'docker_mode' => GithubRunnerDockerMode::class,
             'capacity_wait_timeout' => 'integer',