Keep docsgen from updating protected branches

[webbnh]

Changes introduced with this PR

This PR adds a check to the docsgen reusable workflow which skips the step where it updates the branch if the branch is protected (like main), because attempting the update will result in an error which will cause the workflow (and the rest of the CI) to fail.

We're not supposed to need updates to protected branches, as the updates are supposed to have been applied to PRs before they are merged, so, under normal circumstances, this change should have no impact. (And, if an update is actually required, it should be detected and applied to the next PR to come along, anyway.)

However, under unusual circumstances (such as when a PR is merged too quickly for the bot to respond, or when the bot is producing an unstable result (arcalot/arcaflow-plugin-fio#39)) this change will prevent the main branch CI from failing.

---

By contributing to this repository, I agree to the contribution guidelines.

[webbnh]

Testing complete:

• Performs the update when branch is not protected (log; rerun with debug output)
• Skips update when branch is protected (log)

[dbutenhof]

Yeah, OK; I suppose all the repos must at least have main protected.

[webbnh]

Yeah, OK; I suppose all the repos must at least have main protected.

Yeah, I contemplated filtering based on whether the target was a branch (as opposed to a PR), but our practice has drifted toward using upstream branches for PRs; I considered excluding particular names (e.g., main), but that seemed cumbersome and unreliable; and, I considered ruling out tags (either by name or as a class). I finally concluded that, since the harm only arises when the bot is unable to push the commit, and that happens only when the branch is protected, I sould use that as the basis of the filter, since GitHub conveniently offers a test for it.

And, yeah, the main branch should be protected. (And, if it's not, then I guess the bot is free to update it....)