run workflows in proper places (#350)

.github/workflows/osv-scanner-pr.yaml

@@ -3,9 +3,9 @@ name: OSV-Scanner PR Scan
 # Change "main" to your default branch if you use a different name, i.e. "master"
 on:
   pull_request:
-    branches: [main]
-  merge_group:
-    branches: [main]
+  push:
+    branches:
+      - main
 
 permissions:
   # Require writing security events to upload SARIF file to security tab

.github/workflows/secscan.yaml

@@ -3,7 +3,10 @@ name: "Security Scan"
 # Run workflow each time code is pushed to your repository and on a schedule.
 # The scheduled workflow runs every at 00:00 on Sunday UTC time.
 on:
+  pull_request:
   push:
+    branches:
+      - main
   schedule:
   - cron: '0 0 * * 0'