Re-apply: workflows: Use main-branch-only environment when using ISSUE_SUBSCRIBER_TOKEN (#179990) (#193801)
This way we can prevent the secret from being used in user branches.
We originally reverted this because it was spamming the PRs with
'deployment' messages. GitHub has added a new feature to disable these
messages, so it should be safe to re-apply this.