Fix Github trust issues

It seems that Github blocks using main repo secrets by default when
using `pull_request` and changing it to `pull_request_target` fixes it.