ci: scope push trigger to main to drop redundant PR runs

[abnobdoss]

Change

Make push triggers more consistent by having the test workflows run branch pushes only on main. Pull requests still run the same checks, and tag builds are unchanged.

The duplicate-run case is narrow: it only happens for branches pushed directly to the Apache repo, so it mostly affects committers and bots rather than normal fork-based contributors. Pull request checks cover those branch updates; direct main runs still give us post-merge CI and warm caches.

Also cleans up nearby on: sections so the triggers are easier to compare, including removing zizmor's redundant all-branches pull request filter.

Validation

Checked that all workflow YAML files still parse.

Remaining Trigger Inconsistencies

These are intentional or out of scope, so this PR leaves them alone:

• Test workflows still run on all tag pushes to preserve release behavior.
• rc only runs on release-candidate tags.
• pre-commit still runs on regular branch pushes because it is cheap.
• docs, cpp-linter, license_check, and codeql keep their narrower rules.

Related discussion: #799.

[zhjwpku]

Reasonable, thanks for keeping improve the CI workflows :-)

[wgtmac]

Thanks @abnobdoss and @zhjwpku!