Adjust GitHub-Actions to work with PRs from forked repositories (#21)

* Add `pull_request_target` GHA trigger and use `trusted-checkout` action

To also run GHA jobs for pull requests from forked repositories, add a
new `pull_request_target` trigger. With this trigger, GHA runs do not
have restricted privileges (so they are able to push images for example)
but, by default, the runs will be based on the target repository instead
of the pull request's content. To still checkout the pull request's
content, consistently use the `trusted-checkout` action which will do a
manual checkout of the PR in case the author is either `COLLABORATOR`,
`MEMBER` or `OWNER`.

* Use more stable `v1` branch instead of `master` for GHA from cc-utils

---------

Signed-off-by: Jonas Brand (8R0WNI3) <j.brand@sap.com>

Author: 8R0WNI3

.github/workflows/build.yaml

@@ -13,7 +13,7 @@ on:
 
 jobs:
   prepare:
-    uses: gardener/cc-utils/.github/workflows/prepare.yaml@master
+    uses: gardener/cc-utils/.github/workflows/prepare.yaml@v1
     permissions:
       id-token: write
     with:
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
     - name: Export odg-extension-definitions
       run: |
         export version=${{ needs.prepare.outputs.version }}
@@ -42,7 +42,7 @@ jobs:
 
         tar czf ${blobs_dir}/extension_definitions.tar.gz ${extension_definitions}
 
-    - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@master
+    - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
       with:
         ocm-resources: |
           name: odg-extension-definitions
@@ -55,7 +55,7 @@ jobs:
 
   helmcharts:
     name: Build Helmcharts
-    uses: gardener/cc-utils/.github/workflows/helmchart-ocm.yaml@master
+    uses: gardener/cc-utils/.github/workflows/helmchart-ocm.yaml@v1
     needs:
       - prepare
     permissions:

.github/workflows/non-release.yaml

@@ -1,5 +1,6 @@
 name: CI (non-release)
 on:
+  pull_request_target:
   push:
   workflow_dispatch:
 
@@ -14,7 +15,7 @@ jobs:
       mode: snapshot
 
   component-descriptor:
-    uses: gardener/cc-utils/.github/workflows/post-build.yaml@master
+    uses: gardener/cc-utils/.github/workflows/post-build.yaml@v1
     needs:
       - build
     permissions:

.github/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
       mode: release
 
   release-to-github-and-bump:
-    uses: gardener/cc-utils/.github/workflows/release.yaml@master
+    uses: gardener/cc-utils/.github/workflows/release.yaml@v1
     needs:
       - build
     permissions: