chore(cli-integ): integ workflow cannot check out pull requests from forks

[mrgrain]

This unblocks the CLI integration test workflow, which can no longer check out the head commit of a pull request from a fork.

actions/checkout now refuses that by default, on both v6 and v7, because checking out fork code from a pull_request_target workflow means running untrusted code in a privileged context. Our integ workflow does exactly that on purpose: it exists to run a contributor's changes against real AWS environments, so checking out the fork head is the whole point and the workflow cannot function without it. We therefore opt back in with allow-unsafe-pr-checkout and leave a comment recording why.

This is safe for the same reasons it was before the input existed. The workflow already pins the checkout to head.sha rather than head.ref to avoid a TOCTOU attack where the branch is moved after approval, obtaining OIDC credentials for a throwaway test environment is the intended outcome, and every other credential the workflow touches sits behind a GitHub environment protection rule that requires a maintainer to approve the run.

The bump from v6 to v7 is incidental tidiness rather than a requirement — the new input is available in both — but since we are touching this step anyway it may as well move to the current major.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version: https://github.com/actions/checkout/releases/tag/v7.0.0

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/integ.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/integ.yml

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.30%. Comparing base (b7783b5) to head (5ebb07f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1846      +/-   ##
==========================================
- Coverage   90.35%   90.30%   -0.05%     
==========================================
  Files          80       80              
  Lines       12159    12159              
  Branches     1727     1725       -2     
==========================================
- Hits        10986    10980       -6     
- Misses       1139     1145       +6     
  Partials       34       34              

Flag	Coverage Δ
suite.unit	90.30% <ø> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.