Security: sample-tests.yaml `go` job runs fork-controlled scripts on a self-hosted runner with GCP credentials and a live DB password (missing the fork gate that tests.yaml has)

## Problem

The `go` job in [`.github/workflows/sample-tests.yaml`](https://github.com/GoogleCloudPlatform/alloydb-auth-proxy/blob/main/.github/workflows/sample-tests.yaml) triggers on plain `pull_request`, so **any fork PR** that touches `examples/go/**` passes the `changes` paths-filter (which runs on fork PRs via the workflow's own `pull-requests: write` token) and reaches a job that:

- checks out the **PR head** (`repository: head.repo.full_name`, `ref: head.sha`),
- runs on `[self-hosted, linux, x64]` with `id-token: write`,
- mints **GCP credentials** via `google-github-actions/auth` (WIF), and
- fetches a **live AlloyDB cluster password** from Secret Manager into the environment

…and then executes the PR's own `examples/go/run_tests.sh` — i.e. fully fork-controlled code runs on the self-hosted runner with those credentials in its environment, with no maintainer involvement. The public run history shows the `go` sample job executing for fork PRs.

The sibling `integration` job in [`tests.yaml`](https://github.com/GoogleCloudPlatform/alloydb-auth-proxy/blob/main/.github/workflows/tests.yaml) runs on the same self-hosted label and carries exactly the gate this job is missing:

```yaml
if: |
github.event_name != 'pull_request' ||
(github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
```

so the omission reads as an oversight rather than a decision.

## Suggested fix

Apply the same gate to the `go` job (composed with its existing paths/schedule condition). I had opened #970 with that one-change patch before seeing this repo prefers issue-first — happy to rebase/reopen it (or whatever variant you prefer) once we agree the gate is wanted. Thanks!