Automate fork pull request from outside collaborators

[tim-schilling]

There's a step in the repo onboarding called: Under Actions > General > "Fork pull request workflows from outside collaborators", set "Require approval for first-time contributors"

Ideally we could do this with terraform.