fix(ci): allow checkout of fork PR code in pull_request_target workflow

actions/checkout v7 now refuses to fetch fork pull request code in
pull_request_target workflows by default to prevent pwn request
attacks. Add allow-unsafe-pr-checkout: true to the e2e workflow
checkout step that needs to build and test fork PR code with
repository secrets.

Signed-off-by: Zaki Shaikh <zashaikh@redhat.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: zakisk

.github/workflows/e2e.yaml

@@ -126,10 +126,14 @@ jobs:
       TESTRR_BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       TESTRR_RUN_LABEL: gha-e2e-${{ matrix.provider }}
     steps:
+      # Safe: external contributor PRs do not run this workflow without
+      # an explicit maintainer ok-to-test approval (see the permission
+      # check step below).
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.target_ref || github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Check user permissions on PRs
         if: github.event_name == 'pull_request_target'