nilsreichardt/Verify "safe to test" label

Secure pull_request_target workflows by requiring maintainer approval for fork-based PRs.

Trust Signals

name	description	required	default
label	The name of the label required to pass the check. Always passes if the pull request is not from a fork.	no	safe to test
require-reapproval	When `true`, removes the label on every workflow run to force re-review of each workflow run. When you set this to `false`, an attacker could push malicious code after you marked the code as safe with the label.	no	true
repo-token	The GitHub token used to manage labels when require-reapproval is `true`	no	${{ github.token }}

no outputs