Switch the Spell checking workflow from pull_request_target to pull_request #51438

Summary of the Pull Request

Switch the Spell checking GitHub Actions workflow from pull_request_target to pull_request so PRs from forks receive a read-only token by default, rather than the workflow's configured repository write permissions.

Impact on PR feedback

• 
  PRs from forks: Automatic spelling comments and SARIF reports will no longer be available on the PR. Contributors must open the failed spelling check's logs or job summary to find errors and fix guidance. Pushing fixes automatically reruns the check.


• 
  PRs from repository branches: Automatic PR comments and SARIF uploads are unchanged.

Validation Steps Performed

Not yet tested on GitHub: the repository's spelling workflow is currently manually disabled.