chore: update pytest workflow. (#32)

* update pytest workflow.

* Run against the pull request, not the target.

This hides secrects like GITHUB_TOKEN, which we do not need.

* Avoid typing_extensions.

TypedDict is in Python proper since like 3.8. or 3.9. But also read

    https://news.ycombinator.com/item?id=21307640

.github/workflows/pytestPR.yaml

@@ -1,7 +1,10 @@
 name: "PyTest PR"
 
 on:
-  pull_request_target:
+  # Use pull_request, not pull_request_target because we run arbitrary code in
+  # this workflow. c.f.
+  # https://nathandavison.com/blog/github-actions-and-the-threat-of-malicious-pull-requests
+  pull_request:
     types:
       - opened
       - edited
@@ -15,14 +18,14 @@ jobs:
         python-version: ["3.13"]
     steps:
       - uses: actions/checkout@v3
-      - name: developer mode install
-        run: pip install -e .
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install pytest dependencies
         run: pip install pytest pytest-md pytest-emoji
+      - name: developer mode install
+        run: pip install -e .
       - uses: pavelzw/pytest-action@v2
         with:
           emoji: false

src/blueair_api/const.py

@@ -1,5 +1,5 @@
 from collections.abc import Mapping
-from typing_extensions import TypedDict
+from typing import TypedDict
 
 SENSITIVE_FIELD_NAMES = [
     "username",