ci(secrets): allow ci to use gh package secrets

[maxcao13]

Fixes #126

Not sure if it works because my fork doesn't own a gh repo token that is authenticated for use for pulling a -core dependency - does the fix make sense?

[ebaron]

This makes sense, but we'll want to guard against unauthorized access to secrets using the safe-to-test label used in other repos:
https://github.com/cryostatio/cryostat/blob/7ec485552750296463d19ad9075347badc60c312/.github/workflows/pr-ci.yml#L29

We'll also need to revise the repo and ref that gets checked out for PRs:
https://github.com/cryostatio/cryostat-operator/blob/1a02ba82282cec37931b9993970dc416c0e1d08a/.github/workflows/ci.yaml#L45-L46

[andrewazores]

Whoops:

https://github.com/cryostatio/cryostat-agent/actions/runs/5279418179/jobs/9550060578

The safe-to-test label needs to be checked only for PR CI runs, not on push (merge) to main.

This repo doesn't currently have a split definition for push-ci vs pr-ci, so I think it'll need that done too.

[ebaron]

Whoops:

https://github.com/cryostatio/cryostat-agent/actions/runs/5279418179/jobs/9550060578

The safe-to-test label needs to be checked only for PR CI runs, not on push (merge) to main.

This repo doesn't currently have a split definition for push-ci vs pr-ci, so I think it'll need that done too.

This is how @tthvo worked around it in the operator CI: https://github.com/cryostatio/cryostat-operator/blob/1a02ba82282cec37931b9993970dc416c0e1d08a/.github/workflows/ci.yaml#L41

[andrewazores]

That's a good solution too, that way it keeps the single definition but has that conditional check only when applied to a PR run.