use pull_request_target

[rachmari]

Why:

From:

In order to protect public repositories for malicious users we run all pull request workflows raised from repository forks with a read-only token and no access to secrets. This makes common workflows like labeling or commenting on pull requests very difficult.

We need workflows that run on forks to be able to read the FREEZE secret in the github/docs repo. This updates the workflow to use the pull_request_target event, which allows using the base repos secrets in a workflow.

Added workflow_dispatch for good measure. We can use this to run this workflow on a different branch to test it out.

[github-actions]

👋 Hey there spelunker. It looks like you've modified some files that we can't accept as contributions. The complete list of files we can't accept are:
translations/**
lib/rest/static/**
.github/workflows/**
.github/CODEOWNERS
translations/**
assets/fonts/**
data/graphql/**
lib/graphql/**
lib/redirects/**
lib/rest/**
lib/webhooks/**

You'll need to revert all of the files you changed in that list using GitHub Desktop or git checkout origin/main <file name>. Once you get those files reverted, we can continue with the review process.