Project option to disable passing variables to PR

[sgotti]

Currently the variable system let user filter variables by branch, tag, ref so just setting a when condition on all branches/tags or specific refs makes possible to not pass any variable to pull requests. This is very useful since a malicious user could just open a pr adding a run step that executes the env command to print all the environment variables and if some of these variables is defined in the config as from_variable it could leak some secrets.

To make all of this simpler and less error prone and avoid users explicitly define a when condition to exclude pull request we could just add a project option (perhaps enabled by default) to not pass any variable when the run is triggered by a pull request.

This should probably be done only on forked pull requests since pull request from the same repos means that the users have access to the main repo.