[Security] Review needed for pull_request_target usage in CI

### Security Concern

I would like to report a potential security issue related to GitHub Actions workflow security best practices.

**Location:** `.github/workflows/pr-linux-test.yml`

**Concern:** The workflow uses `pull_request_target` and interacts with secrets. According to GitHub's own documentation on "Keeping your GitHub Actions and workflows secure", this pattern should be reviewed carefully to avoid secret exposure from forked PRs.

I have specific details and proof but cannot post them publicly.
Can a security team member please reach out to me so I can share details privately?

My email: ha0099661@gmail.com

Thanks for keeping VSCode secure.