fix: check-pr-title job has prompt injection (#18)

## Description

Currently, the `check-pr-title` job has a security vulnerability. If you give the PR a bad title, the job can run arbitrary code.

## Changes

- Fix prompt injection by pulling the PR title as an environment variable.
- Also, restricted the job to only `pull_request` trigger.

### Design Decisions

- It is better to pull out this job into a separate workflow with a unique trigger, but I chose not to because it is currently only one job.

## Checklist

- [x] Tests pass
- [x] Docs updated

Reviewed-on: #18
Co-authored-by: M.V. Hutz <git@maximhutz.me>
Co-committed-by: M.V. Hutz <git@maximhutz.me>

.gitea/workflows/ci.yml

@@ -9,9 +9,11 @@ jobs:
   check-pr-title:
     name: Check PR Title
     runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    env:
+      TITLE: ${{ gitea.event.pull_request.title }}
     steps:
       - run: |
-          TITLE="${{ gitea.event.pull_request.title }}"
           if ! echo "$TITLE" | grep -qE '^(WIP: )?(feat|fix|docs|chore|ci|test|refactor|perf|build|style|revert)(\(.+\))?(!)?: .+'; then
             echo "::error::Pull Request title must follow conventional commits"
             exit 1