Separate workflow from nuget publishing

**Describe your use case**
Separate main PR workflow from nuget publishing. Forks while preferred, should also be treated as unsafe until verified. A safer approach for accessing secrets when building NuGet packages from fork PRs is to use a separate workflow triggered by workflow run. This allows one to have a CI workflow on the pull_request event (without secrets) for basic build and test, and then a subsequent workflow (with secrets) that can handle package publishing after the initial CI has passed and the code is deemed safe.

**Describe alternatives solutions you've considered**
None

**Additional context**
None

Start by locating the existing pull-request CI and NuGet publishing workflows. Review how fork pull requests access secrets, then separate the build-and-test workflow from the package-publishing workflow as described. Done means fork code is treated as unsafe until verification and publishing occurs only after the initial workflow has passed.

Written by the indexing model from the issue text.