ci: only upload empty SARIF for pull_request events (#6353)

Restrict empty SARIF upload to pull_request events only, so that
push-to-develop (e.g. after merging a text-only PR) does not overwrite
the real CodeQL results in the Security tab with an empty SARIF.

.github/workflows/codeql.yml

@@ -236,7 +236,7 @@ jobs:
           fi
 
       - name: Create empty SARIF file
-        if: needs.analyze.result == 'skipped'
+        if: needs.analyze.result == 'skipped' && github.event_name == 'pull_request'
         run: |
           cat <<'EOF' > "${{ github.workspace }}/empty.sarif"
           {
@@ -250,7 +250,7 @@ jobs:
           EOF
 
       - name: Upload empty SARIF for skipped analysis
-        if: needs.analyze.result == 'skipped'
+        if: needs.analyze.result == 'skipped' && github.event_name == 'pull_request'
         uses: github/codeql-action/upload-sarif@e34fc2711fb7964ca6850c8a8382121f34745f3b # v4.32.4
         with:
           sarif_file: ${{ github.workspace }}/empty.sarif