ci: Run external-collaborator workflow on pull_request_target

[mydea]

See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

You can see e.g. here: https://github.com/getsentry/sentry-javascript/actions/runs/9888865345/job/27313696886 that this lacks permissions when run as pull_request. Now, this should ran in the context of the base branch, which grants proper rights etc. and also prevents leaking etc.

[github-actions]

size-limit report 📦

Path	Size
@sentry/browser	22.31 KB (0%)
@sentry/browser (incl. Tracing)	33.65 KB (+0.02% 🔺)
@sentry/browser (incl. Tracing, Replay)	69.42 KB (+0.01% 🔺)
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	62.75 KB (+0.01% 🔺)
@sentry/browser (incl. Tracing, Replay with Canvas)	73.48 KB (+0.01% 🔺)
@sentry/browser (incl. Tracing, Replay, Feedback)	86.13 KB (+0.01% 🔺)
@sentry/browser (incl. Tracing, Replay, Feedback, metrics)	87.99 KB (+0.01% 🔺)
@sentry/browser (incl. metrics)	26.59 KB (0%)
@sentry/browser (incl. Feedback)	38.98 KB (0%)
@sentry/browser (incl. sendFeedback)	26.92 KB (0%)
@sentry/browser (incl. FeedbackAsync)	31.54 KB (0%)
@sentry/react	25.05 KB (0%)
@sentry/react (incl. Tracing)	36.69 KB (+0.01% 🔺)
@sentry/vue	26.41 KB (0%)
@sentry/vue (incl. Tracing)	35.53 KB (+0.01% 🔺)
@sentry/svelte	22.44 KB (0%)
CDN Bundle	23.52 KB (0%)
CDN Bundle (incl. Tracing)	35.42 KB (+0.02% 🔺)
CDN Bundle (incl. Tracing, Replay)	69.53 KB (+0.01% 🔺)
CDN Bundle (incl. Tracing, Replay, Feedback)	74.73 KB (-0.01% 🔽)
CDN Bundle - uncompressed	69.02 KB (0%)
CDN Bundle (incl. Tracing) - uncompressed	104.79 KB (+0.02% 🔺)
CDN Bundle (incl. Tracing, Replay) - uncompressed	215.18 KB (+0.01% 🔺)
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	227.9 KB (+0.01% 🔺)
@sentry/nextjs (client)	36.57 KB (+0.02% 🔺)
@sentry/sveltekit (client)	34.3 KB (+0.01% 🔺)
@sentry/node	130.81 KB (0%)
@sentry/node - without tracing	91.89 KB (0%)
@sentry/aws-serverless	117.06 KB (0%)