Approval for running fork pull request workflows from contributors

I would be useful to control via `.asf.yaml` the "Approval for running fork pull request workflows from contributors" setting in Settings > Actions > General.
The setting offers the following options:

> - **Require approval for first-time contributors who are new to GitHub**
> Only users who are both new on GitHub and who have never had a commit or pull request merged into this repository will require approval to run workflows.
> - **Require approval for first-time contributors**
> Only users who have never had a commit or pull request merged into this repository will require approval to run workflows.
> - **Require approval for all external contributors**
> All users that are not a member or owner of this repository and not a member of the `apache` organization will require approval to run workflows.

### Rationale

We try to give our contributors feedback about their PRs as fast as possible, which includes running our entire test suite. Currently, however, all external contributors need to wait for a maintainer to approve the workflows.

From a security perspective it should be safe to change the value of the GitHub setting to "Require approval for first-time contributors" and allow known contributors to trigger the PR workflows. Workflows triggered by `pull_target` run in a sandbox and:

- no secrets are available.
- do not have write access to the repository.

The worst damage such a workflow can do is running a BitCoin miner, but I believe we can trust **old** contributors not to do that.

Start with the .asf.yaml schema and locate how GitHub Actions workflow settings are represented and applied. Compare the three approval modes listed in the issue; the work is done when the selected mode can be configured through .asf.yaml and is reflected in the repository's GitHub Actions settings.

Written by the indexing model from the issue text.