[8.x] github-actions: pull_request in forked PRs cannot change permis…

…sions scope (#196550) (#196623)

# Backport

This will backport the following commits from `main` to `8.x`:
- [github-actions: pull_request in forked PRs cannot change permissions
scope (#196550)](#196550)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Victor
Martinez","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-17T01:33:19Z","message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:all-open"],"title":"github-actions:
pull_request in forked PRs cannot change permissions
scope","number":196550,"url":"https://github.com/elastic/kibana/pull/196550","mergeCommit":{"message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/196550","number":196550,"mergeCommit":{"message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88"}}]}]
BACKPORT-->

Co-authored-by: Victor Martinez <[email protected]>

.github/workflows/oblt-github-commands.yml

@@ -8,19 +8,20 @@
 name: oblt-github-commands
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - labeled
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   comment:
     if: ${{ github.event.label.name == 'ci:project-deploy-observability' }}
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with: