GCP User IAM workflow update pull request trigger to pull_request_target and adjust permissions

Author: ksobrenat32

.github/workflows/beam_Infrastructure_UsersPermissions.yml

@@ -30,7 +30,7 @@ on:
       - main
     paths:
       - 'infra/iam/users.yml'
-  pull_request:
+  pull_request_target:
     paths:
       - 'infra/iam/users.yml'
 
@@ -41,7 +41,7 @@ concurrency:
 
 #Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
 
 jobs:
@@ -85,6 +85,6 @@ jobs:
         run: gh pr comment ${{ github.event.pull_request.number }} --body-file comment_body.txt
 
       - name: Terraform Apply
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'apache/beam'
         working-directory: ./infra/iam
         run: terraform apply -auto-approve tfplan