fix: run license check safely for fork PRs

[Al-assad]

Summary

• run the license workflow on pull_request instead of pull_request_target
• upgrade checkout to actions/checkout@v4
• use the default low-privilege fork PR checkout instead of opting into unsafe checkout

Validation

• parsed .github/workflows/license-eyes.yml successfully as YAML
• git diff --check

Context

The existing pull_request_target job now fails before the license scan because actions/checkout refuses to check out fork code in a privileged workflow. This PR itself may still show that legacy check failure because pull_request_target workflows are loaded from the default branch; the new workflow takes effect after merge.