ci: run browser tests on pull_request_target

[nschonni]

pull_request_target allows runs to access the secret values. Since this adds an attack vector described here https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ I added the extra condition to only run on the main repo push or if someone adds a safe to test label after reviewing the code

[ctavan]

Great improvement, I didn't know npm ci before.

[ctavan]

Thank you for this contribution. I think the security risk in this case is acceptable.

[broofa]

Question: What happens if a PR is tagged "safe to test" and then subsequently modified by the author (e.g. in some malicious way)?

(Not questioning this PR. Just a general question I've had for awhile.)

[nschonni]

From my understanding, because the trigger is labeled, it gets triggered the first time that it's added, but wouldn't on subsequent pushes till the label is re-applied to trigger that event again