Since we move to GH-hosted runners, we can now revert pull_request_target to pull_request for our CI.

The only piece missing is the upload/download of urunc binaries (which we currently do in a self-hostd s3). We could use github artifacts (and we could keep those when we tag, so that we can upload to the release).

We should also add chksum support for the binaries, and (if possible) sign them.