Add pull_request_target workflows for community PRs - #1386

Adds companion -target.yml workflows to support community PRs that need
secrets access, following the established pattern from bitwarden/clients.

Problem:
Community PRs from forks fail when workflows require secrets (Azure auth,
GitHub App tokens, etc.) because fork PRs don't have access to repository
or organization secrets when triggered via pull_request events.

Solution:
Created three new -target.yml workflows that use pull_request_target:
- build-wasm-internal-target.yml
- build-android-target.yml
- enforce-labels-target.yml

These workflows:
1. Use check-run.yml to validate the triggering actor has write permissions
2. Only run for external forks (not internal PRs)
3. Call the existing workflows with secrets: inherit
4. Require manual approval - they show as "action_required" and must be
   re-run by a maintainer after code review

Security safeguards:
- No direct checkout of PR code (calls reusable workflows)
- Fork detection: github.event.pull_request.head.repo.full_name != github.repository
- Permission validation via check-run.yml
- Manual maintainer approval required before execution

Workflow for maintainers:
1. Community PR is opened
2. Workflows fail with "action_required" status
3. Maintainer reviews PR code for safety
4. Maintainer clicks "Re-run jobs" on failed checks
5. Workflows run with secrets access after permission validation

This follows the same pattern used in bitwarden/clients for
build-cli-target.yml, build-browser-target.yml, etc.

Problem 1: trigger-wasm-publish was firing on all fork PRs
- Added event_name check to ensure it only runs on push events
- Changed condition from `github.ref == 'refs/heads/main'` to
  `github.event_name == 'push' && github.ref == 'refs/heads/main'`
- This prevents the production npm publish from triggering on every
  community fork PR

Problem 2: combine job had no checkout under pull_request_target
- Updated PR checkout step to accept both pull_request and
  pull_request_target events
- Changed ref from head.ref to head.sha for more reliable checkout
- Added repository parameter to support fork PRs
- This ensures the combine job can actually run when called from
  build-android-target.yml

The pull_request trigger still runs on fork PRs, but fork PRs don't
have access to secrets or write permissions. This causes the following
jobs to fail:

In build-android.yml:
- combine: needs packages:write for gradle publish
- check-android-breaking-changes: needs AZURE_* secrets

In build-wasm-internal.yml:
- trigger-breaking-change-check: needs AZURE_* secrets

Added fork detection to skip these jobs for external PRs:
  if: github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository

This ensures:
- Internal PRs run all checks normally via pull_request
- Fork PRs skip secrets-dependent jobs in pull_request run
- Fork PRs get secrets-dependent jobs via pull_request_target after
  maintainer approval