What previously handled by ifNeedApproval is replaced with
two calls implemented in trust.go:
- getPullRequestCommitAndApproval
when workflows are collected and before runs are generated
from them, figure out if
- they need approval
- they should run from the base or the head
- setRunTrustForPullRequest
when a pull request run is created from a detected workflow,
set the information it will need for trust management
