Solve the premissions problem

[ewjoachim]

• If this action is used as a target of a pull_request event, then external users creating PRs will trigger actions whose github token won't have the right to post comments.
• The solution would be to split between a pull_request workflow that will compute the message to be posted and store it in an artifact, and a workflow_run workflow that will post the said comment WITHOUT checking out the code.
• This 2nd workflow will be more sensitive in terms of what it can do, because it will have a write token.

[ewjoachim]

So this is solved in https://github.com/ewjoachim/python-coverage-comment-action.

I'm not sure I'm willing to spend a lot of time fixing it here.