Switch to pull_request_target in labeler workflow

[mastercactapus]

This pull request switches the labeler workflow to use pull_request_target instead of pull_request as the event trigger.

The difference is that pull_request_target defaults to running checkout commands from the BASE branch, instead of the merge commit.

The reason for this is so that outside contributors/forked repos can't open PRs that execute their own code.

---

To analyze changes, we now check out the codebase twice: once is the base branch (e.g., usually master) and runs the labeler script from there only. It runs git diff from the merge checkout location, so the numbers are from there.

This allows external PRs to have the labeler run and apply labels, but only by executing code from a branch already in the repo (i.e., created by those with write-access) rather than the incoming code.

Lastly, this means that changes to the labeler script will only take effect AFTER they have been merged, so to validate labeler updates in the future, a separate PR will need to be opened against the branch in question.

For validation of THIS PR:

We cd into the merge checkout, and then execute the script from the ../base dir

• https://github.com/target/goalert/actions/runs/11220065690/job/31187409228?pr=4102#step:4:1

---

Output:

• https://github.com/target/goalert/pull/4102/files
• https://github.com/target/goalert/actions/runs/11220065690/job/31187409228?pr=4102#step:4:43