Ooh, I've just discovered that you can enable actions on GitHub pull requests by default! This is the actions settings page.
My understanding is that GitHub introduced these limits to prevent people trying to run cryptominers on GitHub actions. Sounds like GitHub has largely fixed it.