- At present, it's too complicated to rely on rulesets in combination
with `pull_request` so it makes sense to turn it off for the main
repository.
- Leave SARIF reporting enabled by default for repositories other than
PowerDNS/pdns.
- When active, public repositories will need to add a code scanning
ruleset if they want to use pull requests that are not cross-forks
and they should not accept pull requests from forks as processing
won't work.
- For private repositories, unless you're using GHEC and paying for
Advanced Security, you'll want to set a repository actions variable
`DO_NOT_USE_SARIF_REPORTING` (see `/settings/variables/actions`) to
`1` to disable SARIF.
- This commit fixes the logic for that.