Change some workflows using pull_request to use pull_request_target instead (#112161)

* Change workflows to use pull_request_target instead of pull_request event
* Add CODEOWNERS entry
* Add initial readme

Author: carlossanlop

.github/CODEOWNERS

@@ -112,3 +112,4 @@
 /docs/area-owners.*                                 @jeffhandley
 /docs/issue*.md                                     @jeffhandley
 /.github/policies/                                  @jeffhandley @mkArtakMSFT
+/.github/workflows/                                 @dotnet/runtime-infrastructure

.github/workflows/README.md

@@ -0,0 +1,6 @@
+# Workflows
+
+General guidance:
+
+- Please make sure to include the @dotnet/runtime-infrastructure group as a reviewer of your PRs.
+- Do not use the `pull_request` event. Use `pull_request_target` instead, as documented in [Workflows in forked repositories](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflows-in-forked-repositories) and [pull_request_target](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target).

.github/workflows/check-no-merge-label.yml

@@ -4,8 +4,8 @@ permissions:
   pull-requests: read
 
 on:
-  pull_request:
-    types: [opened, edited, reopened, labeled, unlabeled, synchronize]
+  pull_request_target:
+    types: [labeled, unlabeled]
     branches:
       - 'main'
       - 'release/**'

.github/workflows/check-service-labels.yml

@@ -4,8 +4,8 @@ permissions:
   pull-requests: read
 
 on:
-  pull_request:
-    types: [opened, edited, reopened, labeled, unlabeled, synchronize]
+  pull_request_target:
+    types: [labeled, unlabeled]
     branches:
       - 'release/**'