Allow GitHub Actions job notifications to be filtered by `main` branch

For Apache Iceberg repos like `apache/iceberg-rust`, we enabled GitHub Actions job notifications with:
```
notifications:
jobs: ci-jobs@iceberg.apache.org
```
Example configuration:
https://github.com/apache/iceberg-rust/blob/713e2016230c46624f0debba23363430fc3715c4/.asf.yaml#L62-L68

The main use case is to notify the project CI mailing list when CI fails or recovers on the `main` branch.
However, the list currently also receives notifications for CI runs triggered by PRs or feature branches. Those checks are useful in GitHub, but we do not want them emailed to the shared CI list.

For example, see: https://lists.apache.org/list?ci-jobs@iceberg.apache.org:lte=1M:iceberg-rust
- "[GH] (iceberg-rust/**file-io-list-prefix**): Workflow run "CI" is working again!" -- from a PR
- "[GH] (iceberg-rust/main): Workflow run "Security audit" is working again!" -- from `main` branch

What we would like is an option to filter notifications.jobs so emails are sent only for workflow runs on main.

Expected behavior:
* CI failure/recovery on main → email sent
* CI failure/recovery from a PR → no email
* CI failure/recovery from a feature branch → no email

One possible configuration could be:
```
notifications:
jobs:
email: ci-jobs@iceberg.apache.org
branches:
- main
```
This would send job notifications only for workflow runs on the main branch.

Currently, maintainers have to work around this by adding manual filters in their email clients, which is inconvenient and does not prevent the unnecessary emails from being sent to the shared list.

Would this feature be useful to support?

Start with the linked .asf.yaml example around lines 62-68 and trace how the existing notifications.jobs configuration is defined and handled. Done means runs on main send failure or recovery emails, while PR and feature-branch runs do not.

Written by the indexing model from the issue text.