Tests run only on push, not PR

It's easy to change, but perhaps this was intentional. (For example, does running the GitHub actions [`run-tests`](https://github.com/Imageomics/pybioclip/blob/main/.github/workflows/run-tests.yml) workflow potentially expose secrets?)

Should at least check / investigate.

@johnbradley if you remember why you set it up this way, perhaps you have a chance to comment accordingly.

Start with .github/workflows/run-tests.yml and inspect its event triggers, permissions, and use of secrets. Determine whether running the workflow on pull requests is safe, then document the rationale and update the workflow only if the investigation supports doing so.

Written by the indexing model from the issue text.