Switch github action pushes to pull-requests and remove write access to code from botmobile

Checklist

• I have used the search function to see if someone else has already submitted the same bug report.
• I will describe the problem with as much detail as possible.

App

Thunderbird for Android

App version

9.0

Where did you get the app from?

None

Android version

all

Device model

No response

Steps to reproduce

1. Audit the .github/workflows/ and switch all git pushes to pull requests.

• For shippable_builds.yml this will likely need another step similar to pre_publish after the PR's are proposed, where they can be reviewed/merged, and then the workflow can be approved to continue.

2. Remove 'write access to code' from botmobile. Associated links:

• https://github.com/thunderbird/thunderbird-android/settings/installations
• https://github.com/thunderbird/thunderbird-android/pull/8960

Expected behavior

No git pushes in github workflows and no 'write access to code' for botmobile

Actual behavior

Github workflows push directly to code and botmobile has 'write access to code'

Logs

No response

Audit the workflows under .github/workflows/, paying particular attention to shippable_builds.yml and its pre_publish step. Review pull request 8960 and the botmobile installation settings first. Done means workflows propose pull requests instead of pushing directly, shippable builds can be reviewed and approved before continuing, and botmobile no longer has write access to code.