Not usable for PRs from forks

Currently this action is not usable for PRs from forks because secrets are not available in this case – and you currently enforce a login to Docker Hub.

The recommended solution (see Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests) is to split this up in two parts. For this action this probably would mean:

1. Work without credentials for PRs from forks in on pull_request:
   • Build the image with outputs: type=oci,dest=image.tar
   • Upload the PR number and the image tarball as artifacts
2. In on workflow_run:
   • Download the artifacts
   • Log in to Docker Hub
   • Run docker/scout-action with image: archive://image.tar and giving the PR number as an option

Actually, most of this should be doable today already. But I don't see how the action gets the correct PR to comment on in this case. This probably will need a new config to pass the PR number.

(Of course it would be a lot easier if the Scout service had a different way to authenticate. Maybe via the "Docker Inc" GitHub app?)

Start by tracing the action's current authentication and PR-comment flow, then review the proposed on pull_request and on workflow_run split. Check how image.tar, the PR number, Docker Hub login, and docker/scout-action are passed between the workflows. Done means fork PRs build without secrets, the artifact is processed securely, and the result is associated with the correct PR.