ci: allow forks to use secrets under aproval

[smoya]

Context

PR's made from forks can't succeed on CI because their actions doesn't have access to the GH secrets stored at repository level. That's solved by changing the on: pull_request to on: pull_request_target (See docs), however that would allow any PR on any fork to use the secrets without previous validation.

Description

This PR changes the on: pull_request to on: pull_request_targeton the CI workflow and additionally adds a check for forcing external contributions (PR's made from forks) to be manually approved by @timescale/ts-vector team before running CI.

In that way, it is the responsibility of @timescalde/ts-vector to carefully check any PR doesn't do any unexpected thing with secrets.

The work is based on this article: https://datachain.ai/blog/testing-external-contributions-using-github-actions-secrets

I decided to keep the approach on having two GH environments and always run in one of them instead of only setting the environment when an external contribution happens.
The reason is that in this way, we could add, at any moment, high privileged secrets in such environment without "leaking" them to forks.

At this moment, there are no specific secrets per environment, just using the ones set as global repository secrets