Run CI on pull requests to release branches

Patch releases are prepared on a release-* branch cut from their tag,
and CI only ran on pull requests to main. Pushes to a release branch
stay untriggered, as zizmor treats a push trigger on release branches as
a publishing workflow whose setup-ruby cache could be poisoned.

.github/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [ main ]
   pull_request:
-    branches: [ main ]
+    branches: [ main, "release-*" ]
 
 permissions: {}