CI: Fix the 'Greet First-Time Contributors' workflow

[seisman]

The "Greet First-Time Contributors" workflows works well for issues (#4815 (comment)), but not for pull requests (e.g., #4808, https://github.com/GenericMappingTools/pygmt/actions/runs/31300559514/job/93216830178?pr=4808).

This PR fixes the issue by changing the triggering event from pull_request to pull_request_target.

I didn't test it. Will know if it works or not when merging #4771.

[seisman]

zizmor marks pull_request_target as a dangerous trigger:

    --> .github/workflows/welcome.yml:7:1
     |
   7 | / on:
   8 | |   pull_request_target:
   9 | |     types:
  10 | |       - opened
  11 | |   issues:
  12 | |     types:
  13 | |       - opened
     | |______________^ pull_request_target is almost always used insecurely
     |
     = note: audit confidence → Medium
     = help: audit documentation → https://docs.zizmor.sh/audits/#dangerous-triggers

but maybe it's OK since the workflow only contains one action?

[weiji14]

Let's not risk it, especially for PRs. Too hard to secure against random actors nowadays.

I think first time contributors opening a PR get a pop up on the GitHub UI that points to contributing.md so we could just put this info there?

[seisman]

Do you mean adding a new section to CONTRIBUTING.md?

[weiji14]

This is how it looks like if I visit a repo with a CONTRIBUTING.md that I haven't made a PR for before:

So yeah, we could just transfer what's under the pr_message: | line to the CONTRIBUTING.md file. I think most of the content overlaps already, so maybe just need a few extra sentences.

[seisman]

OK. Closing the PR.