Hotfix — replaces pull_request_target with pull_request to stop granting write permissions and secrets to fork PRs. Some workflows will break; can be fixed properly later.
Co-authored-by: Cody Robibero <cody@robibe.ro>