Turn off CodeQL for pushes to non-ToT branches

[bzbarsky-apple]

Problem

We end up running CodeQL for things like test event cherry-picks

Change overview

Only run it for pushes to master.

Testing

Tried pushing to my fork of the connectedhomeip, both to master and a non-master branch. The push to master ran CodeQL; the non-master branch did not.

[github-actions]

Size increase report for "esp32-example-build" from 6d61387

File	Section	File	VM
chip-shell.elf	.flash.text	32	32
chip-lock-app.elf	.flash.text	64	64

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-temperature-measurement-app.elf and ./pull_artifact/chip-temperature-measurement-app.elf:

sections,vmsize,filesize

Comparing ./master_artifact/chip-shell.elf and ./pull_artifact/chip-shell.elf:

sections,vmsize,filesize
.flash.text,32,32
[Unmapped],0,-32

Comparing ./master_artifact/chip-pigweed-app.elf and ./pull_artifact/chip-pigweed-app.elf:

sections,vmsize,filesize

Comparing ./master_artifact/chip-persistent-storage.elf and ./pull_artifact/chip-persistent-storage.elf:

sections,vmsize,filesize

Comparing ./master_artifact/chip-all-clusters-app.elf and ./pull_artifact/chip-all-clusters-app.elf:

sections,vmsize,filesize

Comparing ./master_artifact/chip-lock-app.elf and ./pull_artifact/chip-lock-app.elf:

sections,vmsize,filesize
.flash.text,64,64
[Unmapped],0,-64