Allow fork PRs from trusted authors via author_association, not only fork owner patterns #69313

Summary

on.pull_request.forks accepts repository or owner patterns, and the default is same-repository PRs only. In private or internal repositories where collaborators work from personal forks, the set of fork owners is open-ended. The only option that covers them is forks: ["*"], which also admits fork PRs from authors with no relationship to the repository.

Proposal

Let forks: also accept a list of author associations, for example:

on:
  pull_request:
    forks:
      author-association: [OWNER, MEMBER, COLLABORATOR]

The compiler would add one OR branch next to the existing head.repo.id == github.repository_id check:

contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)

The default stays unchanged. The list is explicit, so a repository can leave out MEMBER where organization membership does not imply repository access.

Notes

• This matters only where fork PR runs can use secrets, for example private or internal repositories where an administrator enabled sending secrets to workflows from fork pull requests. Elsewhere the agent job cannot authenticate anyway.
• author_association is computed by GitHub from the author's relationship to the base repository.

Alternatives considered

• forks: ["*"] is too broad.
• Editing the compiled lock file after every compile works but is overwritten by the next gh aw compile.