fix(ci): harden test262 PR workflow security

[iammdzaidalam]

Closes #5158.

This replaces the old test262_pr.yml flow with a safer two-phase setup:

• test262.yml: runs under pull_request with minimal permissions and executes the test262 suite on PR code
• test262_comment.yml: runs under workflow_run in the base repository context and updates the PR comment from an uploaded artifact

Main changes:

• remove untrusted execution from pull_request_target
• disable persisted checkout credentials in the run workflow
• keep the trusted comment workflow isolated from PR code
• pass results through an artifact and use body-path for comment updates

This preserves the reporting behavior while avoiding execution of PR code in a privileged workflow context.

[github-actions]

Test262 conformance changes

Test result	main count	PR count	difference
Total	52,963	52,963	0
Passed	50,079	50,079	0
Ignored	2,072	2,072	0
Failed	812	812	0
Panics	0	0	0
Conformance	94.55%	94.55%	0.00%

Tested main commit: 26271b7c3f6f357f12fd835a0402d8b643f03db5
Tested PR commit: 1dd231995579d60b4b5108fbf3d3cbb9e77614eb
Compare commits: 26271b7...1dd2319

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.56%. Comparing base (6ddc2b4) to head (1dd2319).
⚠️ Report is 894 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #5159       +/-   ##
===========================================
+ Coverage   47.24%   59.56%   +12.31%     
===========================================
  Files         476      580      +104     
  Lines       46892    63236    +16344     
===========================================
+ Hits        22154    37665    +15511     
- Misses      24738    25571      +833     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jedel1043]

Cool, thanks