Enable PR-based app images from forks

[poikilotherm]

What steps does it take to reproduce the issue?

When opening a PR from a fork's branch, the Github Action to push an application image containing the merged code to GHCR does not work because of missing credentials access. Workflows running on a branch from a forked repo never has secrets access to avoid the security risk of malicious workflows stealing credentials.

This has the (bad) consequence that these pull request show as "failed" also the important checks are fine.

What did you expect to happen?

Just push that image... 🙄

Any related open or closed issues to this bug report?

This is a follow up to #9444 / #9447.

[pdurbin]

If anyone would like to listen to a discussion of this, from https://ct.gdcc.io

• 2023-04-27 meeting (notes, recording)

In short, @poikilotherm has a plan, which we discussed at tech hours on Tuesday. Thanks, Oliver! ❤️

Because Oliver is planning a pull request, I think the effort on the IQSS side is quite small, so I'll give this a 3.