Fix duplicated GitHub action runs

[dsander]

It is not recommended to use pull_request_target when code is executed
that could modify the repository.

[dsander]

When this is merged pronto will probably not be able to comment on PR anymore because it does not have the right permissions. This is really difficult to test because the actions seem to behave differently depending on the repository they are running from/on. The same PR on my fork passes CI: dsander#2

I think what we want is something like the setup described here (search for CommentPR.yml). Do you know how the commenting worked with TravisCI? Was there a GitHub token in the CI secrets?

[ashkulz]

It's fine if we remove pull_request_target -- but why is the pull_request failing for Ruby 2.4? It happens on this PR as well.

[ashkulz]

I created #399 which still ran the duplicated runs, but weirdly enough it was successful for 2.4 🤷‍♂️

[dsander]

I think that is/was because depending on the trigger and origin of the PR (either a fork or on this repository) the commits are checked out differently, but I am not 100% sure.