Allow running integration and E2E tests in tests workflow for external contributors

Is there an existing issue for this?

• I have searched the existing issues

Problem Statement

KTF's integration and E2E tests require secrets to run (for the Kong license, and for access to GKE). That makes them fail for PRs from external contributors. We'd like to run them against every PR, therefore we need to come up with a solution to that.

Proposed Solution

Trigger tests.yaml workflow on pull_request_target and ensure that in case a pull request author is an external contributor, the PR has to have a predefined label assigned (e.g. verified-for-running-ci) that would be assigned by a reviewer after ensuring that no potential secrets leak can happen due to the changes from PR.

Implement the workflow described by Michael Heap in his blogpost.

Additional information

No response

Acceptance Criteria

• Integration and E2E tests can be run against PRs submitted by external contributors

Start by reading the tests.yaml workflow and the linked blog post about accessing secrets from forks. Determine how integration and E2E tests currently use the Kong license and GKE access, then define a safe workflow for external pull requests. Done means those tests run against PRs from external contributors without exposing secrets.