Make FOSSA vulnerability gate report-only on pull_request events

[m9p909]

What is the purpose of this change?

When a repo sets sca_scanning.fossa.vulnerability.mode: BLOCK, the gate previously failed the build on critical/high vulnerabilities in every context — including pull_request runs. The intent of BLOCK is to gate releases (and manual full scans), not to fail contributor PRs. This change exempts pull_request events from the vulnerability blocking step so PRs always report (never fail) on vulns, while release/manual scans keep the BLOCK behavior.

How is this accomplished?

One condition added to the Block on FOSSA Vulnerability Failures step:

         if: |
           always() &&
+          github.event_name != 'pull_request' &&
           !inputs.skip_vulnerability_gate &&
           steps.fossa_vulnerabilities.outcome == 'failure' &&
           steps.config.outputs.fossa_vulnerability_mode == 'BLOCK'

The vulnerability scan still runs on PRs and still posts its PR status check / comment (enable_status_check/enable_pr_comment on pull_request), and the check itself is already continue-on-error: true — so PRs surface findings without failing the job. Two supporting edits keep the run output honest:

• The SCA summary now prints "REPORT ONLY" (not "BLOCKING") for vuln failures on PRs.
• The usage-notes "Gates" section documents that BLOCK is release/manual-only and PRs are always report-only.

The licensing gate is intentionally unchanged.

Anything reviews should focus on/be aware of?

• Org-wide behavior change. Every consumer of sca-scan-and-guard.yaml that runs it on PRs with vulnerability.mode: BLOCK will see PR vuln gates become non-blocking after this merges. Today the PR vuln check runs in diff mode (only newly introduced critical/high vulns can fail), so the practical change is: a PR that introduces a new critical/high CVE will no longer be blocked at PR time — it will instead be caught at release. Confirm that matches the intended policy before merging.
• The emergency bypass (skip_vulnerability_gate, admin-only) and licensing gate are untouched.
• Driver: maas-core is enabling vulnerability.mode: BLOCK for releases (SolaceDev/maas-core#4993) and wants PRs to remain report-only.