Harden comment workflow artifact handling and permissions

[theinfosecguy]

Summary

• Restrict the workflow_run comment job to successful runs whose head repository matches the base repository.
• Remove unnecessary pull-requests: write permission and keep least-privilege issues: write for PR comment creation.
• Validate comment.json schema and bounds before posting to avoid blindly trusting artifact content.

Testing Done

• Reviewed workflow conditions and permission scope.
• Verified payload validation enforces required fields and body limits.
• CI run validation in upstream repository by maintainers.

[ChrisCarini]

LGTM! Consider contributing this upstream, too!