Skip Docker Hub login and push for PR/Dependabot workflow runs

[Copilot]

Dependabot runs of the Docker Image workflow fail with Error: Username and password required, since secrets.DOCKERHUB_* are not exposed to those runs — and publishing isn't wanted there anyway.

Changes

• Gate publishing on a single flag — job-level publish env, false for pull requests and Dependabot actors; Login to Docker Hub is now conditional on it.
• Fix the push guard — push: previously checked github.event_name != 'pull_request', which never matches Dependabot's branch pushes; without a login that step would fail with denied. It now follows publish.
• Keep the Trivy scan working without a registry — non-publishing runs build linux/amd64 only and load the image into the local daemon, since multi-platform builds cannot be loaded and the scanner needs a resolvable image ref.

env:
  publish: ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
# ...
- name: Login to Docker Hub
  if: env.publish == 'true'
# ...
  platforms: ${{ env.publish == 'true' && env.platforms || 'linux/amd64' }}
  push: ${{ env.publish == 'true' }}
  load: ${{ env.publish != 'true' }}

Net effect: PR/Dependabot runs still build and vulnerability-scan the image, they just skip authentication and publishing.