Split web-preview up into pull_request and workflow_run.

[Jonas-Sander]

Split the workflow into building the code for web via a pull_request trigger, upload the artifact and run a second action on success via the workflow_run trigger, which will upload the builded code to Firebase Hosting. This would seperate building the untrusted code (dangerous) and uploading the code that was just build (not dangerous - hopefully 😉).
The second Action will have access to the secrets, since it is triggered on workflow_run, not pull_request.
This approach is described in more details with examples here.

Copied from #348