fix(workflows): keep v3-alpha's pull_request_target on auto-label-issues

I had the direction backwards in the previous commit on this branch.
v3-alpha already uses pull_request_target (the security-hardened
trigger that lets the workflow label PRs from forks); master is the
one still on the older pull_request. The fix to auto-label-issues
belongs on master, not on v3-alpha. Reverting that part of this PR
so v3-alpha keeps its current behaviour. The unreleased-changelog
permission update remains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: leaanthony

.github/workflows/auto-label-issues.yml

@@ -3,7 +3,7 @@ name: Auto Label Issues
 on:
   issues:
     types: [opened, edited, reopened]
-  pull_request:
+  pull_request_target:
     types: [opened, edited, reopened, synchronize]
 
 jobs: