Change tagbot workflow to run on pull_request_target and comment on security

[Micket]

See https://github.com/actions/labeler?tab=readme-ov-file#permissions

[Micket]

On @ocaisa 's request i reworked the workflow to print a warning if someone modifies the script.

This will not run here yet, since the develop branch version doesn't have pull_request_target yet, so I will make a demonstration on my own repo and link here.

[Micket]

Well this rabbit hole was deep. Had to, like many others, rediscover actions/checkout#518

1. separate checkout for the PR, so that the PR itself has no possible way of impacting the script, and can't do anything sneaky like importing something like "git.py" to indirectly modify it via the script doing import git
2. since i can't rely on merge commit sha, i manually check for a merge conflict
3. I added a workflow tag for anything that changes workflows to highlight possible changes to highlight such (potentially dangerous) changes.

Also other cleanups, tweaks, to make things more robust and nicer.

[Micket]

Example PRs on my own fork to show the bot in action:

1. Updating a software Test tagbot with new easyconfig without touching the workflow or script. Micket/easybuild-easyconfigs#24 (also removed a workflow file, so it gets a workflow tag)
2. Trying to modify the script has no impact (as intended) Modifying the tagbot script directly Micket/easybuild-easyconfigs#31 and there is a workflow tag.
3. Trying to modify workflow yml directly Hack the workflow directly Micket/easybuild-easyconfigs#32 does not impact the PR as intended.

[ocaisa]

The proof will be in the pudding

[ocaisa]

Going in, thanks for all the effort on this @Micket !