Security concern: CI could leak github secrets

I was recently watching a video about NPM's supply chain attack, and how its starting point was the exploitation of a github action. We may be vulnerable to a similar attack to on this repo by a willing malicious actor.

The culprit is on: pull_request_target. This is used in 2 places in our CI: testsuite_preview.yaml and labeler.yaml. The labeler workflow is probably safe (?), but the testsuite_preview is likely exploitable. See this article: https://shreyapohekar.com/blogs/how-attackers-exploit-pull_request_target-secure-your-github-ci-cd-workflows/ . We do exactly what we shouldn't do.

The purpose of that pull_request_target was to be able to have the workflow work for PRs sent from forks.

See also: https://www.wiz.io/blog/s1ngularity-supply-chain-attack

I recommend disabling the PR until a proper security analysis of the pipeline can be done. I unfortunately do not have the time to look into this myself, but please do look into this. I am concerned ☹️

Make sure to disable/remove/fix this CI from other branches as well, not just main.