CI: Code Review Failing in PR

[niklasdewally]

Actions that run on code that lives on a fork of this repository (for example, pull requests) can only have a readonly token to the repository.

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token

This causes code coverage CI to fail.

This needs a more complex security model.

[niklasdewally]

https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

TL;DR
should use readonly pull_request workflow to run arbitrary code then save coverage report to an artifact.
using workflow_run, start a read-write pull_request_target workflow to deploy this to GH actions. This avoids secrets leakage from actions down into arbitrary user code.

[niklasdewally]

#37