ci: use pull_request_target for fork PR secrets access

[cennn]

Summary

• Switch integration_test.yml trigger from pull_request to pull_request_target so that fork PRs can access repository secrets (e.g. HTTP_PROXY, CCR_USERNAME/CCR_PASSWORD).

Why

With pull_request, GitHub does not inject secrets for fork PRs — even after maintainer approval. This causes CI to fail on any fork contribution.

pull_request_target runs the workflow YAML from the base branch (main), so:

1. Fork authors cannot modify the workflow to steal secrets.
2. Secrets are safely injected.
3. _ci_pipeline.yml already checks out the PR commit via head-sha, so no other changes needed.

Security model

• Layer 1 (existing): Fork PRs require maintainer approval before running.
• Layer 2 (this change): Workflow YAML always comes from main — forks cannot alter it.

Test plan

• Open a fork PR and verify CI runs with secrets available.
• Verify internal (non-fork) PRs continue to work as before.

[jiahy0825]

LGTM