Run on PRs from forks

[manno]

This is more complicated than I thought:

• https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#pull_request_target
• https://github.community/t/running-code-from-forks-with-pull-request-target/126688/4

pull-request-target makes sure the workflow definition is from the repo, but secrets might still be exposed to code from the fork.

While the previous workflow looks safe in that regard, it would trigger tests twice if any label was on a local, approved PR.

The duplicated workflow makes sure to checkout the forked code.

#175030373