adapt Github Actions to run on fork PRs

[sleidig]

If external contributors open a PR, some of our automated CI checks fail due to permission issues for required credentials.

We should adapt the actions to pass (maybe by skipping some steps for externals, if necessary). But also not introduce security problems.

Example PR: #3512

See actions/attest-build-provenance#99 (comment)