build(ci): build a reduced matrix on pull requests

.github/workflows/maven.yml

@@ -54,17 +54,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
+        java: [ '17', '21', '25' ]
+        profile: [ '', '-Pjakartaee11' ]
+        exclude:
           - java: '17'
-            profile: ''
-          - java: '21'
-            profile: ''
-          - java: '21'
             profile: '-Pjakartaee11'
-          - java: '25'
+          # Pull requests build the oldest JDK and the newest on Jakarta EE 11; pushes build everything.
+          - java: ${{ github.event_name == 'pull_request' && '21' || 'none' }}
+          - java: ${{ github.event_name == 'pull_request' && '25' || 'none' }}
             profile: ''
-          - java: '25'
-            profile: '-Pjakartaee11'
     steps:
       - name: Checkout code
         if: needs.changes.outputs.code == 'true'

.github/workflows/owasp.yml

@@ -16,7 +16,12 @@
 name: OWASP checkup
 
 on:
+  # Not a required check, so path filtering cannot leave a pull request blocked.
   pull_request:
+    paths:
+      - '**/pom.xml'
+      - 'src/etc/project-suppression.xml'
+      - '.github/workflows/owasp.yml'
   push:
     branches:
       - 'main'