chore: migrate to pull_request_target for some workflows that require GH token permissions (#1354)

Author: ianbotsf

.github/workflows/artifact-size-metrics.yml

@@ -1,6 +1,6 @@
 name: Artifact Size Metrics
 on:
-  pull_request:
+  pull_request_target:
     types: [ opened, synchronize, reopened, labeled, unlabeled ]
     branches:
       - main
@@ -40,7 +40,7 @@ jobs:
       - name: Put Artifact Size Metrics in CloudWatch
         run: ./gradlew putArtifactSizeMetricsInCloudWatch -Prelease=${{ github.event.release.tag_name }}
   size-check:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Sources

.github/workflows/changelog-verification.yml

@@ -4,7 +4,7 @@ permissions:
   id-token: write
 
 on:
-  pull_request:
+  pull_request_target:
     types: [ opened, synchronize, reopened, labeled, unlabeled ]
     branches:
       - main

.github/workflows/kat-transform.yml

@@ -1,7 +1,7 @@
 name: Kat Transform
 
 on:
-  pull_request:
+  pull_request_target:
     types: [ opened, synchronize, reopened, labeled, unlabeled ]
     branches:
       - main