Update CI actions config to build forks, but restricted so that no npm publish or anything is possible

[zakhenry]

See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for notes on how to do this safely