[GitHub Actions] Fix our broken port_pr action after the upgrade to checkout@v7

[tdonohue]

Description

As of checkout@v7, for security reasons the checkout action will always fail when run on the pull_request_target event.

See https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target

However, we need to run the port_pr job on the pull_request_target event to allow it to create backported PRs. We also need to run the checkout command in order to checkout the code which is being backported.

Therefore, this small PR enables the allow-unsafe-pr-checkout option of the checkout job. While this is bypassing security protections, in this scenario I feel we are safe because this job ONLY triggers during PR merger, and we ONLY merge PRs which are tested, reviewed and trusted (and scanned by CodeQL for security).

Therefore, it should not be possible for someone to add code in a PR which can result in an attack on the DSpace codebase. Those attacks should be found by human reviewers, human testers or CodeQL before merger would occur.

This PR also includes a very tiny improvement:

• Ensure this port_pr job will trigger if a port to... label exists on the PR.
  • This doesn't change behavior, as the job currently will run & do nothing if that label doesn't exist. But, this small change just ensures the job doesn't even run if the label doesn't exist.

NOTE: This PR will need to be backported to all active branches to ensure the same settings exist for PRs on all branches. It also must be ported to the DSpace/dspace-angular repository.

Instructions for Reviewers

• Verify you agree with the changed settings in this PR, especially the newly added allow-unsafe-pr-checkout option

[kshepherd]

i am +1 with the acknowledgement that in the event of a problem sneaking into a PR that is approved and merged to main by one of us, we would have to repeat any rollback or mitigation on the 2-3 supported version branches that we reference in our "port to" labels.

[dspace-bot]

Backport failed for dspace-8_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-8_x
git worktree add -d .worktree/backport-12812-to-dspace-8_x origin/dspace-8_x
cd .worktree/backport-12812-to-dspace-8_x
git switch --create backport-12812-to-dspace-8_x
git cherry-pick -x 8e30c93c663936b8a28c8fa55fd3fe672dad1e26

[dspace-bot]

Backport failed for dspace-9_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-9_x
git worktree add -d .worktree/backport-12812-to-dspace-9_x origin/dspace-9_x
cd .worktree/backport-12812-to-dspace-9_x
git switch --create backport-12812-to-dspace-9_x
git cherry-pick -x 8e30c93c663936b8a28c8fa55fd3fe672dad1e26

[dspace-bot]

Successfully created backport PR for dspace-10_x:

• [Port dspace-10_x] [GitHub Actions] Fix our broken port_pr action after the upgrade to checkout@v7 #12818

[tdonohue]

Ported to dspace-angular in DSpace/dspace-angular#5967