feat: update nix build ci to checkout fork if workflow approved

Author: samrose

.github/workflows/nix-build.yml

@@ -31,9 +31,11 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
           fetch-tags: true
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: aws-creds
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -80,4 +82,3 @@ jobs:
           AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
 
     name: build psql bundle on ${{ matrix.arch }}
-