Use pull_request_target on GitHub Actions to allow public forks to run CI without approval

[necojackarc]

Note: Workflows triggered by pull_request_target events are run in the context of the base branch. Since the base branch is considered trusted, workflows triggered by these events will always run, regardless of approval settings. For more information about the pull_request_target event, see "Events that trigger workflows."

See https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks for more details.

Also, add Node v18 to the CI target.