ci: only push containers on main branch not PRs

[alecbcs]

Updating the workflow to only push new containers to the registry when they've been merged into main.

Also updated the workflow to run on GitHub Hosted Runners now that we're GitHub Enterprise and have access to more than 20 concurrent VMs.

[alalazo]

Updating the workflow to only push new containers to the registry when they've been merged into main.

It has been quite handy in the past to retrieve e.g. a PR from here in a corresponding PR on Spack, to try out the modifications in pipelines before they land on main. What would be the workflow if we don't use the registry?

[becker33]

I think @alalazo is right here -- we push to separate tags for PRs, I think it's worth keeping for flexibility since the velocity on this repo is low.

It would be great if we could use the changes action to only update the ones that need updating on each PR.

[alecbcs]

The problem is that anyone who doesn't have write access to the repo can't contribute.

Any PR from a fork will instantly fail CI/CD checks since forks don't have write permission to the container registry.