Run tests in Prs when workflows change

[jku]

We could run the tests workflows in PRs when the workflows change. This is already part of the current tuf-on-ci workflow templates: https://github.com/theupdateframework/tuf-on-ci-template/blob/main/.github/workflows/test.yml

We can do the same for our test workflow(s):

• add the pull_request trigger
• modify the if-clause so that failures in PRs don't file issues

This is most importantly a smoke test for tuf-on-ci upgrade and would have prevented #210 from happening

[jku]

did a quick test in #215. Findings:

• the whole test workflow cannot be run in PR as id_token:write permission is not available in PRs. The custom-smoke-test job requires id_token since it signs with a bunch of sigstore clients...
• we could skip custom-smoke-test when in PR: then we could at lest get the generic smoke-test job
  • makes workflow a little more complicated (yet another if-clause)
  • tested surface is then quite small in PRs
• alternatively we could change custom-test.yml so that it can also test verify only (if id-token is not available)
  • would have fairly good test surface
  • makes custom-test.yml more complicated
• bonus finding: using github.event_name == 'workflow_call' has a smell and I think it might never trigger -- will have to test that (fixed in workflows: validity check is incorrect in test workflows #216)