GitHub pull_request_target Block: Audit Before Monday

GitHub blocks pull_request_target from 2 Dec, with brownouts on 9 and 16 Nov. We audited 202 workflows in 5 major repos — here is what breaks and the fix.