feat(github-runners): allow public repositories and refuse pull request jobs by default

The runner group was limited to private repositories, so jobs from
public repositories never got a runner: Coolify still started a runner
for each matching job, which then waited idle until its timeout.

The runner group now allows every repository of the organization,
public ones too; existing private groups are updated. GitHub gives a
runner any queued job with matching labels, so pull request jobs are
refused inside the runner: a job-started hook fails jobs from
pull_request, pull_request_target and review events before any step
runs, and fails closed when the event is unknown. A new runner setting,
off by default, allows pull request jobs; the settings page then warns
to require approval for fork pull request workflows on GitHub.

database/migrations/2026_10_01_051935_add_allow_pull_requests_to_github_runner_configs_table.php

@@ -0,0 +1,25 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Runners refuse pull request jobs unless this is enabled.
+     */
+    public function up(): void
+    {
+        Schema::table('github_runner_configs', function (Blueprint $table) {
+            $table->boolean('allow_pull_requests')->default(false)->after('is_dedicated');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('github_runner_configs', function (Blueprint $table) {
+            $table->dropColumn('allow_pull_requests');
+        });
+    }
+};