Switch CI trigger from pull_request_target to pull_request

[shchur]

Switches CI from pull_request_target to pull_request.

pull_request_target required a permission_check job plus a safe to test label to decide whether a PR's code should run, and every job needed a duplicate checkout step to pick up the PR head. With pull_request the trigger itself scopes what runs, so all of that goes away.

Fork PRs can't obtain the CI credentials, so the AWS-touching jobs (test_general_cloud, test_tabular_cloud, test_timeseries_cloud) and build_doc are gated on github.event.pull_request.head.repo.full_name == github.repository. They skip cleanly on forks rather than failing, leaving lint as the only check. Maintainer branches pushed to this repo still get the full run.

Changes:

• Drop the permission_check job and the safe to test label handling
• Collapse the duplicated per-job checkout steps into one
• Add the fork guard to the four jobs needing AWS credentials or PR write access
• Update CONTRIBUTING.md and tests/README.md for the new process

Note for reviewers: if branch protection lists required status checks, it needs updating — permission_check no longer exists, and the guarded jobs now report as skipped on fork PRs.