Marionette next

[intrigus-lgtm]

Re: #

• Backport changes from Fix two security issues #15451 to this branch.
  This is needed because pull_request_target uses the workflow of the base/target branch of a PR.
  So if we open a PR against this branch, it would use the old workflow that does not upload the PR comment and if the run_test_cases_pr_comment.yml workflow then runs it would fail to find the comment

---

Continuous Integration

This pull request:

• needs automatic test cases check.

  Manual trigger with @cocos-robot run test cases afterward.

• does not change any runtime related code or build configuration

  If any reviewer thinks the CI checks are needed, please uncheck this option, then close and reopen the issue.

---

Compatibility Check

This pull request:

• changes public API, and have ensured backward compatibility with deprecated features.
• affects platform compatibility, e.g. system version, browser version, platform sdk version, platform toolchain, language version, hardware compatibility etc.
• affects file structure of the build package or build configuration which requires user project upgrade.
• introduces breaking changes, please list all changes, affected features and the scope of violation.