ci: restrict credentialed Custard test job to trusted refs

The test job in custard-run.yaml runs on the workflow_run event in the
base-repository context with id-token: write and authenticates to Google
Cloud as kokoro-system-test@long-door-651. It checks out the triggering
commit and runs `make test`, which runs `npm install` and `npm test`. With
only `if: needs.affected.outputs.paths != '[]'`, a pull request opened from a
fork reaches this job, so fork-controlled npm lifecycle and test scripts run
with the service account credentials present in the workspace.

Gate the job so it runs only for trusted refs: same-repo branches on
workflow_run, plus push and workflow_dispatch. Fork pull requests no longer
execute their code in this privileged context. This matches the boundary the
legacy test job in custard-ci.yaml already enforces
(github.event.pull_request.head.repo.fork == false).

Author: evilgensec

.github/workflows/custard-run.yaml

@@ -102,7 +102,19 @@ jobs:
           status: failure
 
   test:
-    if: needs.affected.outputs.paths != '[]'
+    # These tests authenticate to Google Cloud as the
+    # kokoro-system-test@long-door-651 service account and run repository code
+    # (make test -> npm install -> npm test), so they must only run on trusted
+    # refs. For workflow_run triggers, limit execution to same-repo branches.
+    # Pull requests from forks do not reach the service account credentials or
+    # execute their code in this privileged context; push (post-merge) and
+    # workflow_dispatch runs are unaffected. The legacy test job in
+    # custard-ci.yaml enforces the same boundary with
+    # `github.event.pull_request.head.repo.fork == false`.
+    if: >-
+      needs.affected.outputs.paths != '[]' &&
+      (github.event_name != 'workflow_run' ||
+      github.event.workflow_run.head_repository.full_name == github.repository)
     needs: affected
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit