ci: Update workflow to add labels in PR editing docstrings safe to run from forks

[silvanocerza]

Proposed Changes:

This changes the event that triggers the docstring-labeler.yml workflow from pull_request to pull_request_target.

It also adds a new job to prevent running malicious code.

How did you test it?

Can't be tested.

Notes for the reviewer

This PR has some security implications that we might need to discuss.

This is only one of the possible approaches to label PRs from forks. Other approaches might be:

• Use pull_request event and a different token with elevated privilege
• Use pull_request_target event and embed the Python code in the workflow file
• Use pull_request_target event, checkout base, copy the Python script outside the repo and run that (This might be good 🤔 ), see ci: Update docstring-labeler.yml workflow to safely run in PRs from forks #4146

I recommend reading this blog post to gain a clear view on the security issues.

Am open to different solutions.

Checklist

• I have read the contributors guidelines and the code of conduct
• I have updated the related issue with new insights and changes
• I added tests that demonstrate the correct behavior of the change
• I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test:.
• I documented my code
• I ran pre-commit hooks and fixed any issue

[silvanocerza]

Closing this, we went with the solution from #4146.