fix: allow fork PRs to access secrets in deploy workflow

Use pull_request_target instead of pull_request to run the workflow
in the context of the base repository, enabling secrets access for
fork PRs. Explicitly checkout PR head SHA to build the correct code.

Author: Jonathan Visser

.github/workflows/deploy.yaml

@@ -1,7 +1,7 @@
 name: Deploy application
 
 on:
-  pull_request:
+  pull_request_target:
   push:
     branches:
       - 'master'
@@ -17,6 +17,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       # Declares the repository safe and not under dubious ownership.
       - name: Add repository to git safe directories
         run: git config --global --add safe.directory $GITHUB_WORKSPACE
@@ -52,6 +53,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: download build artifact
         uses: actions/download-artifact@v4
         with: