Secure AirspeedVelocity PR benchmark workflow

[Krastanov-agent]

Summary

• run the AirspeedVelocity benchmark workflow on pull_request instead of pull_request_target
• keep the workflow token read-only with contents: read
• write benchmark results to the job summary via job-summary: true instead of posting PR comments
• keep the branch filter as [master, main] so this file can be reused across repos

This avoids the classic pull_request_target pwn request problem: the old workflow could execute PR-controlled benchmark/package code while holding base-repository privileges.

cc @Krastanov

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.46%. Comparing base (d153227) to head (63edb06).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #517   +/-   ##
=======================================
  Coverage   97.46%   97.46%           
=======================================
  Files         127      127           
  Lines        7766     7766           
=======================================
  Hits         7569     7569           
  Misses        197      197           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Krastanov]

The previous version of the benchmark CI script was dangerous -- fixing this so that the runner can not be misused by external contributors.