ci: allow PRs from downstream forks to pass the rest of actions

[whentojump]

One of our current actions (MishaKav/pytest-coverage-comment@main) requires more permissions than usual, and for now any PR from external forks would fail at this step, due to GitHub's design.

In the "Set up job" section of each action's log, we can inspect the permissions for this particular run. Permissions like the below ones ("read/write") can pass MishaKav/pytest-coverage-comment@main.

GITHUB_TOKEN Permissions
  Actions: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

On the other hand, if only "read" permissions are granted, like below, would fail MishaKav/pytest-coverage-comment@main.

GITHUB_TOKEN Permissions
  Contents: read
  Metadata: read
  Packages: read

And here's a short summary of permissions in several common cases:

• Case 1: direct pushes to main within a repo/fork: depends on "Settings" -- "Actions" -- "General" -- "Workflow permissions", where you can control it's either "read" or "read/write".
• Case 2: PRs that come form downstream forks: always "read", unless pull_request_target is specified as the trigerring condition -- and that's exactly what this PR does

Note:

1. Before this PR gets merged: we'll have to directly push to this repository and create PRs within the repo
2. After this PR gets merged: any WIP patches that were made prior to this commit will have to rebase themselves to include it before this change can take effect

Links:

• https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
• Conversations in Add Cloudlab docs #250 starting from here

[tianyin]

This is awesome! Thank you very much for looking into it @whentojump

any WIP patches that were made prior to this commit will have to rebase themselves to include it before this change can take effect

I think it's fine as long as the PR passed the tests.

We only need to make the latest version green.

[whentojump]

any WIP patches that were made prior to this commit

By that I actually mean PR 247, 249 and 250, but not more ancient ones.

PR 247, 249 and 250 happen to be all authored by myself... (Yeah I'm the only one who ever forked at all, thus the only one affected by this permission problem). They should be easy to rebase.

[whentojump]

I'm going to merge this without further review because

1. I experimented myself in other test repos and see expected results
2. This is (weakly) blocking another PR (249), which in turn (strongly) blocks many incoming patches
3. If this is still not working, the impact should be tiny and under control

[whentojump]

Looks like it's working. Enjoy the green check marks :) @tianyin