Make workflows testable in PRs

.github/workflows/main.yml

@@ -5,6 +5,13 @@ on:
   # However, it's very important that we don't run code from forks without sandboxing it,
   # because that way anybody could potentially extract repository secrets!
   pull_request_target:
+  # pull_request_target makes it very annoying to test updates to the workflow,
+  # because all such runs use the workflow file from the base branch, not the PR.
+  # This can be fixed by _also_ running it on `pull_request` events,
+  # but to not have duplicate runs for every PR, we only do that when any workflows are updated.
+  pull_request:
+    paths:
+      - '.github/workflows/**'
   push:
     branches:
       - master