Require approval for web preview from outside the organization (#227)

Author: Ernesto Castellotti

.github/workflows/preview-pr.yaml

@@ -2,13 +2,23 @@ name: preview-pr
 
 on:
   pull_request_target:
-    types: [opened, reopened]
+    types: [opened, reopened, synchronize]
 
 permissions:
   pull-requests: write 
 
 jobs:
+  authorize:
+    environment:
+      ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: "true"
+      
   build:
+    needs: authorize
     runs-on: ubuntu-latest
     steps:
       - name: Checkout