`pull_request` workflows need approval to run, `pull_request_target` does not. this one isn't particularly vulnerable and doesn't take long to run, so we may as well run it without approval.
`pull_request` workflows need approval to run, `pull_request_target` does not. this one isn't particularly vulnerable and doesn't take long to run, so we may as well run it without approval.