CI workflow for Surge and a11y is broken

[rebeccaalpert]

Describe the enhancement or change
GitHub seems like it's started refusing some CI workflows from forks in PF React.

Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at[ https://gh.io/securely-using-pull_request_target](https://gh.io/securely-using-pull_request_target) and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

We could try using pull_request instead (this requires lower permissions) or some other option.

---

Jira Issue: PF-4511

[coderabbitai]

🔗 Related PRs

#12385 - chore(workflows): align issue label and preview gating [merged]
#12511 - fix(CI): unblock Release workflow documentation job on main pushes [merged]
#12535 - fix(ci): fetch full git history in Promote workflow [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!