[github actions] FINALLY fix the mysterious token error in github actions

[XilaiZhang]

This should finally (with high confidence) fix #141980, the mysterious error where git push sometimes fail.

Root cause:
When a pull request merges onto flutter's master branch, it is actually a merge from a branch on a flutter contributor's repository, to flutter's repository. Therefore, the actor of the pull request event, is the user that opened the pull request. And this actor would not have write access to repo and therefore the repo secret resolves to empty.

Therefore running your pull_request workflow when a pull request merges doesn't work because even though we are not running our workflows on a forked repository, the actor of the pull_request event comes from a forked repository, and secrets are not passed to this actor.

The correct way is using pull_request_target event instead of pull_request event. In workflows triggered by this event, GITHUB_TOKEN is granted read/write repository permission unless the permissions key is specified and the workflow can access secrets, even when the actor of the workflow trigger comes from a fork.
Note that workflows of this event runs in the context of the base commit and not the merge commit. But this doesn't matter for our use case since we are good with using the actions file from the base commit in the pull request event.

Tested:
I was finally able to reproduce the error by:

1. create a pull request under the username of different user other than the repository owner
2. merge and label the pull request, and use the token of this different user, but use it as repository secrets in the workflow
   reproduced error

previously I wasn't able to reproduce this error on my personal repo because the actors in my tests are the same user.

Also tested on my personal repo, following the steps mentioned above, that using the pull_request_event type fixes the error. succeeded run

The Debug Process:
spent quite a while looking at other things during debugging, but they turned out to be unrelated. things that we experimented with are workflow conditions, ssh setup, git push url, manual trigger, workflow env, secret setup, dependency on market place actions (actions/checkout and peter-evans/create-pullrequest)

[CaseyHillers]

Why is this failing on Google testing?

[XilaiZhang]

Why is this failing on Google testing?

created b/322018010 earlier and passed it to current oncall. Yeah sorry I am aware that I have already declined a number of bugs outside my rotation recently, trying to catch up on projects at the moment