[CI] Re-introduce safe workflow mechanism to trigger plan on PR

[bryantbiggs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

What is the outcome that you are trying to reach?

• Re-add mechanism that allows planning (terraform plan) the changed patterns within a PR in a safe manner that cannot be exploited

Describe the solution you would like

• Safe mechanism to plan PR to soft-validate changes

Describe alternatives you have considered

• pull_request_target is not suitable due to its ability to be exploited by external parties

Additional context