[ci] Fix permissions and don't use pull_request_target (#7689)

[ci] Fix permissions and don't use pull_request_target (#7689) #2657