fix(ci): use pull_request_target for labeler workflow

The labeler workflow used pull_request which lacks write permissions on
fork PRs due to GitHub security restrictions. Switching to
pull_request_target runs the workflow in the base repo context and
grants the GITHUB_TOKEN the pull-requests:write permission needed to
apply labels.

Author: bug-ops

.github/workflows/labeler.yml

@@ -1,7 +1,7 @@
 name: PR Labeler
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
 
 permissions: