ci: switch to pull_request_target so forks pass

We comment on our PRs so we need to ensure pull requests from forks work
so switch to PR targets and set permissions.

.github/workflows/code-test.yaml

@@ -8,7 +8,7 @@ on:
       - "python/ironic-understack/**"
       - "python/understack-workflows/**"
       - ".github/workflows/code-test.yaml"
-  pull_request:
+  pull_request_target:
     paths:
       - "python/ironic-understack/**"
       - "python/understack-workflows/**"
@@ -17,6 +17,10 @@ on:
 
 jobs:
   python:
+    permissions:
+      contents: read
+      pull-requests: read
+
     runs-on: ubuntu-latest
 
     strategy: