Support updating release plan when labels are changed on previously-merged PRs

[kategengler]

Using the pull_request event to trigger the workflow when labels are added on PRs from forks runs into permissions issues when the workflow attempts to open or update the release plan PR. This is because PR workflows from forks do not get repo secrets.

The pull_request_target event allows triggering a workflow upon an event on a PR from a fork but does include the secrets. It is not safe to run code from the PR in this workflow and the workflow that runs is from the base branch. Since this workflow only pulls the primary branch, this is safe to use. See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

This can be seen working here:

kategengler/test-rp-new#1

Action that ran when the label was changed on the PR https://github.com/kategengler/test-rp-new/actions/runs/9684295098

[mansona]

I've tested this locally and I'm really happy with it 🎉 I'm setting it as a breaking change because it's a big change in behaviour, though in reality it's not depended on directly so we don't need to follow semver rules 😂

Thanks for solving this one @kategengler 🎉