ci: execute static analysis, fuzzing, and dependency scanner on pull request target

[richardapeters]

No description provided.

[github-actions]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ ACTION	actionlint	12		0	0.07s
✅ CPP	clang-format	951	2	0	7.38s
✅ DOCKERFILE	hadolint	2		0	0.11s
✅ JSON	eslint-plugin-jsonc	9	0	0	3.34s
✅ JSON	jsonlint	9		0	0.2s
✅ JSON	prettier	9	0	0	0.74s
⚠️ MARKDOWN	markdownlint	6	0	4	1.61s
⚠️ MARKDOWN	markdown-link-check	6		2	48.79s
✅ MARKDOWN	markdown-table-formatter	6	0	0	0.37s
✅ REPOSITORY	checkov	yes		no	21.28s
✅ REPOSITORY	git_diff	yes		no	0.05s
✅ REPOSITORY	grype	yes		no	15.94s
✅ REPOSITORY	secretlint	yes		no	8.86s
✅ REPOSITORY	trivy	yes		no	12.15s
✅ REPOSITORY	trivy-sbom	yes		no	1.08s
✅ REPOSITORY	trufflehog	yes		no	5.61s
⚠️ SPELL	lychee	137		2	2.4s
⚠️ YAML	prettier	22	0	1	1.23s
✅ YAML	v8r	22		0	10.8s
✅ YAML	yamllint	22		0	0.7s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by

[rjaegers]

I think the workflows changed in this PR don't actually run in the context of this PR anymore.

[daantimmer]

Are we sure we want this?

pull_request_target event grants workflows triggered by pull requests from forks access to repository secrets and a read/write GITHUB_TOKEN. That is inherently risky if the workflow inadvertently exposes these secrets or allows for unauthorized modifications to the repository.
https://stackoverflow.com/a/74959635