add link to best practices for pull_request_target (#3995)

* add link to blog for pull_request_target

I was initially confused by the intended use of `pull_request_target` and its capabilities, but [this blog post in the Security Lab](https://securitylab.github.com/research/github-actions-preventing-pwn-requests) laid out the caveats and solutions well.

content/actions/reference/events-that-trigger-workflows.md

@@ -596,7 +596,7 @@ This event runs in the context of the base of the pull request, rather than in t
 
 {% warning %}
 
-**Warning:** The `pull_request_target` event is granted a read/write repository token and can access secrets, even when it is triggered from a fork. Although the workflow runs in the context of the base of the pull request, you should make sure that you do not check out, build, or run untrusted code from the pull request with this event. Additionally, any caches share the same scope as the base branch, and to help prevent cache poisoning, you should not save the cache if there is a possibility that the cache contents were altered.
+**Warning:** The `pull_request_target` event is granted a read/write repository token and can access secrets, even when it is triggered from a fork. Although the workflow runs in the context of the base of the pull request, you should make sure that you do not check out, build, or run untrusted code from the pull request with this event. Additionally, any caches share the same scope as the base branch, and to help prevent cache poisoning, you should not save the cache if there is a possibility that the cache contents were altered. For more information, see "[Keeping your GitHub Actions and workflows secure: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests)" on the GitHub Security Lab website.
 
 {% endwarning %}