fix(ci): use pull_request_target for fork PR label permissions

The pull_request event gives fork PRs a read-only GITHUB_TOKEN,
causing the label step to fail with 403. pull_request_target runs
in the base repo context with the declared write permissions.

Author: caio-pizzol

.github/workflows/pr-labels.yml

@@ -1,7 +1,7 @@
 name: PR Labels
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
 
 permissions: