ci: update merge_group trigger logic in security-scan.yml

[AlexanderBarabanov]

What does this PR do?

This PR updates the .github/workflows/security-scan.yml workflow to ensure that security scans treat merge_group trigger the same as pull_request.

Before submitting

• This PR fixes a typo or improves the docs (you can dismiss the other checks if that's the case).
• Did you make sure to update the documentation with your changes?
• Did you write any new necessary tests?

[mramotowski]

LGTM we can consider using contains(fromJSON('["pull_request","merge_group"]'), github.event_name) in future.