Try to run Coverity Scan on demand

This way we can run the scan when the PR is still open and catch issues
before merging.

Signed-off-by: Simo Sorce <simo@redhat.com>

.github/workflows/coverity-scan.yml

@@ -2,13 +2,15 @@
 name: Coverity Scan
 
 on:
-  push:
-    branches: ["main"]
+  pull_request:
+    types:
+      - labeled
   schedule:
     - cron: '41 3 * * 0'
 
 jobs:
   coverity:
+    if: github.event.label.name == 'covscan'
     name: Coverity Scan
     runs-on: ubuntu-22.04
     container: fedora:latest