fix(codeql): run workflow for pushes to main and pull requests

[pichlermarc]

Which problem is this PR solving?

CodeQL only runs on a schedule and on workflow_dispatch at the moment.
This PR applies the Security SIGs recommendation to run CodeQL on pushes to main. The PR also removes the schedule but retains the ability to run on workflow_dispatch.

See #4101
See open-telemetry/sig-security#15

Type of change

• internal

[codecov]

Codecov Report

Merging #4110 (ad46cf1) into main (f6ebf0e) will not change coverage.
The diff coverage is n/a.

❗ Current head ad46cf1 differs from pull request most recent head d11fb36. Consider uploading reports for the commit d11fb36 to get more accurate results

@@           Coverage Diff           @@
##             main    #4110   +/-   ##
=======================================
  Coverage   90.52%   90.52%           
=======================================
  Files         159      159           
  Lines        3757     3757           
  Branches      835      835           
=======================================
  Hits         3401     3401           
  Misses        356      356           

[pichlermarc]

Tests failing due to npm@10 not supporting node 16 and 14 - see #4111

[codeboten]

Thanks for this change @pichlermarc, looks great