Avoid triggering push for Dependabot branches

[brcrista]

The CodeQL run is failing for Dependabot (example):

Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.

This is disabling the push trigger for Dependabot branches so they will trigger on pull_request instead.

Alternatively, we could just do push:branches:main, but I'm not sure if we still want to trigger on push for other branches.