fix: require environment approval for fork PRs in pull_request_target workflows

Fork PRs using pull_request_target bypass GitHub's standard approval gate
while having access to repository secrets. This adds a conditional
`cloud-tests` environment that requires reviewer approval only for fork PRs,
while keeping internal PRs and push events unaffected.

Author: b-per

.github/workflows/ci.yml

@@ -25,6 +25,7 @@ env:
 jobs:
     run-tests:
         runs-on: ubuntu-latest
+        environment: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository) && 'cloud-tests' || '' }}
         strategy:
             fail-fast: false
             matrix:

.github/workflows/fusion.yml

@@ -28,6 +28,7 @@ env:
 jobs:
     run-tests:
         runs-on: ubuntu-latest
+        environment: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository) && 'cloud-tests' || '' }}
         strategy:
             fail-fast: false
             matrix: