github: Safer pull_request_target defaults for GitHub Actions checkout

GitHub is changing the default behavior of the Actions checkout action for workflows triggered by pull_request_target to reduce common security mistakes. The goal is to avoid exposing base-branch credentials or secrets to untrusted pull request code.

• Source: GitHub