.github/workflows/pr-checklist: switch to pull_request_target and scope permissions

To make `main` the authoritative workflow source.

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>