github/add-copyright-headers: Opt in to fork checkout on actions/checkout v7 - #2194

Fixes #2193

actions/checkout v7 refuses fork pull request code on pull_request_target unless allow-unsafe-pr-checkout is set, so add-copyright-headers has failed at the Checkout step on every pull request from a fork since #2140 (#2180, #2185, #2192). This sets the opt-in. The job only runs the copywrite CLI over the checkout and does not build or execute repository code; the risk review guidance is linked next to the setting.

Reverting the pull request restores the previous behavior. The alternative, running on pull_request and only checking with copywrite headers --plan, is described in #2193 if the opt-in is not acceptable.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.
  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.