alter on: to ensure PRs from forks get upstream permissions

this should allow the default token to have enough perms to label
issues, even if the PR is coming from a fork.

.github/workflows/adr-labeler.yml

@@ -1,22 +1,20 @@
 name: ADR Labeler
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
     paths:
       - 'docs/adr/**'
 
 jobs:
   label-adr:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-
+
     steps:
       - uses: actions/github-script@v7
         with:
           script: |
-            # Adding ADR label - if it already exists, this is a no-op
+            // Adding ADR label - if it already exists, this is a no-op
             github.rest.issues.addLabels({
               owner: context.repo.owner,
               repo: context.repo.repo,