## About The Pull Request
The `pull_request_target` trigger by default checks out the head ref of
the PR but runs with the secrets of the base ref, which a bad actor can
take advantage of, GitHub blocks the most common vector of this by
default now. Changes the workflows to explicitly check out the base ref
(the branch being PRed to, instead of the branch being PRed) because
neither of these jobs specifically requires that it be the head ref
being checked out
## Why It's Good For The Game
Changelogs and GBP will work again
## Changelog
No