ci(docs): harden docs.yml workflow security

- Replace pull_request_target with pull_request
- Tighten top-level permissions to contents: read
- Guard docs-verify to skip fork PRs
- Restrict docs-build to non-PR events only
- Remove commented-out unit-tests block

Author: clanghans

.github/workflows/docs.yml

@@ -13,13 +13,10 @@
 name: Verify and Build Docs
 
 permissions:
-  contents: write
-  pages: write
-  pull-requests: write
-  id-token: write
+  contents: read
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, reopened, synchronize]
   push:
     branches:
@@ -31,20 +28,17 @@ on:
 
 jobs:
   docs-verify:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
     permissions:
       pull-requests: write
       contents: read
     with:
       bazel-docs-verify-target: "--lockfile_mode=error //:docs"
 
-  # unit-tests:
-  #   uses: ./.github/workflows/itf.yml
-  #   secrets: inherit
-
   docs-build:
-    needs: [docs-verify]  # add unit-tests here when ready
-    if: ${{ always() && needs.docs-verify.result == 'success' }}
+    needs: [docs-verify]
+    if: github.event_name != 'pull_request'
     uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
     permissions:
       contents: write