ci: revert to using pull_request_target

[Fdawgs]

• Fixes benchmark workflow failing to run
• Fixes labeller workflow failing to run
• permissions explicitly set in ci: reduce workflow permissions to minimum #3828 should negate security concerns of pull_request_target, as noted in the warning section in the GitHub Actions docs here
• Removes Git credentials and auth token after checkout in the benchmark workflow's benchmark job, to further negate security concerns of pull_request_target; credentials aren't used for anything else after the checkout

Checklist

• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[RafaelGSS]

LGTM.

[mcollina]

lgtm

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.