This PR implements the approach recommended by this article from Github's ‘Security Lab’ to allow the usage of secrets on PRs from forks of the message_ix repository.

• Add a "receive" CI workflow.
  • Run on all PRs into main.
  • Fail if (a) the PR is from a fork and (b) it does not have a certain label, currently "safe to test".
• Adjust the "pytest" CI workflow:
  • Add a workflow_run: event trigger. Invoke this trigger every time the "receive" workflow completes (success or failure).
  • Skip the main pytest and tutorials jobs if the "receive" workflow failed.
  • Invoke actions/checkout with the right options to use the fork PR branch.

With this merged, it would be up to some user with ‘write’ permissions on the current repo to give a first look-over of any PR from and then add the "safe to test" label. (The label could also be removed again at any time.)

How to review

Per the documentation:

This [workflow_run] event will only trigger a workflow run if the workflow file is on the default branch.

This means we will need to:

• Merge this PR.
• Create or update another PR (Add .util.sankey and tutorial #770 was suggested).
• Confirm that the pytest workflow is invoked and runs successfully; if not, open a follow-up PR to adjust the workflow(s).

PR checklist

• Continuous integration checks all ✅
• Add or expand tests; coverage checks both ✅ N/A; CI changes only
• Add, expand, or update documentation.
• Update release notes.