(but really GitHub should retire `pull_request_target` or surface some kind of big ol’ warning on it)