Secure AirspeedVelocity PR benchmark workflow

[Krastanov-agent]

Summary

• run the AirspeedVelocity benchmark workflow on pull_request instead of pull_request_target
• keep the workflow token read-only with contents: read
• write benchmark results to the job summary via job-summary: true instead of posting PR comments
• keep the branch filter as [master, main] so this file can be reused across repos

This avoids the classic pull_request_target pwn request problem: the old workflow could execute PR-controlled benchmark/package code while holding base-repository privileges.

cc @Krastanov

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (4c07eb1) to head (9871644).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@          Coverage Diff           @@
##           master     #30   +/-   ##
======================================
  Coverage    0.00%   0.00%           
======================================
  Files           1       1           
  Lines         114     114           
======================================
  Misses        114     114           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.