CI for pull requests

Right now we only run CI when we commit to the primary branch. It would be great to run CI on PRs to pick up on any issues sooner. However, we rely on access to secrets, which adds additional complexity in order to ensure the secrets are secured properly. See https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/