Consider omitting PR comments for PRs from forks #452

We currently use a pattern which is flagged by zizmor for posting comments from firehose health checks to PRs. It needs to use a workflow_run to elevate permissions enough to post a comment - when a PR comes from a fork there are tighter restrictions on the CI workflows by default because it's running untrusted code.

This pattern can be safe if no code from the PR can be executed in the action, but we can't automatically verify that our usage is safe. #451 tightens some non-meaningful vulnerabilities where a malicious actor could get us to write a comment in the wrong place and I'm reasonably confident that the existing usage is safe.