GHSA-32h8-5xqg-h466: Gitea Actions fork workflow trust through pull request review commit

Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a GITEATOKEN with write access to the repository. Review-triggered workflows now run on the pull request head.