From 2 Dec 2026 GitHub Actions blocks pull_request_target by default in public repos. Find affected workflows and migrate them safely, step by step.