[PM-15126] Tighten scope of our client build pipelines to remove reliance on secrets (#12243)

* feat: create copy of desktop build for PR target

* chore: add temporary file to trigger ci

* fix: remove check-run from regular desktop build

* feat: change browser build to not use pr target

* fix: skip build-safari if secret is not available

* feat: skip safari build if secrets are not available

* feat: let windows desktop build without secrets

* fix: has_secrets not being output correctly

* feat: let macos desktop build without secrets

* feat: don't build browser as part of desktop

* feat: change CLI to pull_request

* feat: let web build without secrets

* feat: tweak lint to run on PR and not just push

* feat: add PR target workflows

* fix: remove wip files

* fix: lint on hotfix-rc branches

* feat: add new workflows to CODEOWNERS

.github/workflows/lint.yml

@@ -1,12 +1,20 @@
 name: Lint
 
 on:
-  push:
+  pull_request:
+    types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
       - 'cf-pages'
     paths-ignore:
       - '.github/workflows/**'
+  push:
+    branches:
+      - 'main'
+      - 'rc'
+      - 'hotfix-rc-*'
+    paths-ignore:
+      - '.github/workflows/**'
   workflow_dispatch:
     inputs: {}