fix: secure format.yml workflow by using PRs instead of direct pushes

Co-authored-by: gcatanese <1771700+gcatanese@users.noreply.github.com>