Fix typo-check in CI, run only for pull requests because of security reasons

[lhotari]

Motivation

typo-check is currently broken in CI,

Downloading 'typos' v1.22.5
--[20](https://github.com/apache/bookkeeper/actions/runs/9485228747/job/26136650763?pr=4426#step:3:22)24-06-12 15:31:09--  https://github.com/crate-ci/typos/releases/download/v1.[22](https://github.com/apache/bookkeeper/actions/runs/9485228747/job/26136650763?pr=4426#step:3:24).5/typos-v1.22.5-x86_64-unknown-linux-musl.tar.gz
Resolving github.com (github.com)... 140.82.112.3
Connecting to github.com (github.com)|140.82.112.3|:443... connected.
HTTP request sent, awaiting response... 404 Not Found
20[24](https://github.com/apache/bookkeeper/actions/runs/9485228747/job/26136650763?pr=4426#step:3:26)-06-12 15:31:09 ERROR 404: Not Found.

example: https://github.com/apache/bookkeeper/actions/runs/9485228747/job/26136651150?pr=4426#step:3:21

Changes

• use v1.22.4 which contains the binary for linux-musl
• limit running typos check for pull requests because of security reasons
  • we shouldn't use any external actions for builds that run in the security context of the repository

[eolivelli]

+1

[lhotari]

I also reported the issue here: crate-ci/typos#1034 . However this PR will also address the security hole that was opened by using an external action in our CI.

[hezhangjian]

Thanks I'll make sure to adjust the approach accordingly for future contributions.