[ci] Fix permissions and don't use pull_request_target

[ci] Fix permissions and don't use pull_request_target #2655