Change CI workflow trigger
--------------------------

Change CI workflow to run on PRs. Prior to this, the trigger for a CI
build was a push to the repo. This meant that PRs from forks did not
trigger a CI run, so they could never meet the requirements of the
branch protection rules.

A repo maintainer must approve the workflow run for PRs from external
forks, in order to prevent abuse. This is already configured.

Restrict upload of code coverage report to Code Climate
-------------------------------------------------------

Restrict the coverage report upload to builds triggered by:

* pushes to master (these are mainly merges of PRs);

* pushes of version number tags; and

* PRs not raised from forks or by Dependabot

PRs from forks or Dependabot do not have access to the secrets needed
to upload the report to Code Climate, and there's no point tainting
their CI builds with failures from the coverage upload.

A few branch protection rules depended on the report being uploaded.
These have been removed so that PRs from forks and Dependabot can
actually pass CI.

Push a tag to set the gem version and build the gem
---------------------------------------------------

Pushing a tag of the format vX.Y.Z will trigger a CI test run and then
build the gem and push it to Ruby Gems if the tests pass. The gemspec
will automatically set the version number based on the tag.

This is done in a new job in the CI workflow. This requires access to
a secret but, as the workflow will have been triggered by a push, the
workflow will have access to the secrets in this case.