ci: keep the dependency audit visible on pull requests without blocking them

The audit had moved off the pull_request trigger entirely, which left a window in which a tag could be cut from a merge the audit had not seen. It runs on pull requests again as an advisory job (continue-on-error), stays blocking on the push run for main and on the daily schedule, and a tag is only ever cut from a green push run.

.github/workflows/security.yml

@@ -101,7 +101,11 @@ jobs:
   dependency-audit:
     name: Dependency Audit
     runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
+    # Runs on pull requests too, but advisory: an advisory published against a
+    # dependency the branch did not touch must not block the branch. The push
+    # run on main and the daily schedule stay blocking, and a tag is only ever
+    # cut from a main whose push run is green.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1