feat(codecatalyst): also scan pull requests targeting main

[joeymussalli]

Summary

• The CodeCatalyst workflow only ran on PUSH to main, so PRs never got a Trustabl gate until merge.
• Add a PULLREQUEST trigger for OPEN/REVISION against main (destination branch; run uses the PR head sources per AWS docs).
• Update the CodeCatalyst quickstart to mention PR runs.

Test plan

• Validate the workflow YAML in the CodeCatalyst editor (Triggers parse).
• Open a PR into main in a connected repo and confirm a Trustabl run starts on the source branch.
• Push an update to the PR and confirm a REVISION run.
• Confirm push-to-main still triggers as before.