[BUG] Allow PR Title checks on fork PRs

Signed-off-by: John McCall <john@overturemaps.org>

Author: lowlydba

.github/workflows/omf_pr_checks.yml

@@ -10,11 +10,14 @@
 name: OMF PR Checks
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, edited, synchronize]
 
+# pull_request_target runs with write permissions so this workflow works for fork PRs.
+# SECURITY: This workflow must never check out or execute code from the PR branch.
+# If you need to add a step that does so, use the workflow_run pattern instead.
 permissions:
-  contents: read
+  contents: none
   issues: write
   pull-requests: write
   statuses: write