Fix Schema Diff CI failing to post comment on PRs from forks (#20207)

Fixes: #20167

The `Schema Diff` workflow posts a PR comment showing the effective
schema diff. For PRs from forks, `GITHUB_TOKEN` is downgraded to
read-only, so the comment-posting step was silently failing.

### Changes
- `schema_diff.yml`: only post the comment directly when the PR is from
the same repository. For forked PRs, upload the diff (and PR number) as
a short-lived artifact instead of trying to comment.
- `schema_diff_comment.yml` (new): triggered by `workflow_run` after
`Schema Diff` completes, with `pull-requests: write` permission (granted
because this workflow always runs in the context of the base
repository). It downloads the artifact, if present, and posts the
comment on behalf of the forked PR.

This avoids `pull_request_target`, per the security concerns raised in
the issue (zizmor flags it as dangerous). The new workflow only ever
treats the downloaded artifact as inert comment text -- it is never
executed.

---------

Co-authored-by: Olivier 'reivilibre <oliverw@element.io>

.github/workflows/schema_diff.yml

@@ -1,4 +1,4 @@
-name: Schema Diff
+name: Schema Diff  # If this is changed, need to update `schema_diff_comment.yml` as well
 
 on:
   pull_request:
@@ -95,9 +95,34 @@ jobs:
           echo "⚠️ Schema diff generation failed. See job logs for details." \
             > "${{ runner.temp }}/schema_diff.md"
 
+      # Post a comment.
+      #
+      # For same-repo PRs, we can do this directly and we are done.
       - name: Post sticky PR comment
         uses: marocchino/sticky-pull-request-comment@3d7b8546315c63df45a03981d50a43ec19237f80 # v3
-        if: always()
+        # Only run for same-repo PRs
+        if: always() && github.event.pull_request.head.repo.full_name == github.repository
         with:
           header: schema-diff
           path: ${{ runner.temp }}/schema_diff.md
+
+      # For PRs from forks, we only have a read-only `GITHUB_TOKEN` here and need to work around
+      # by triggering a `workflow_run` onto the main repo.
+      #
+      # We upload an artifact and the `schema_diff_comment.yml` workflow will be triggered
+      # on the main repo by this workflow exiting.
+      - name: Save PR number for forked PRs
+        # Only run for fork PRs
+        if: always() && github.event.pull_request.head.repo.full_name != github.repository
+        run: echo "${{ github.event.pull_request.number }}" > "${{ runner.temp }}/pr_number"
+
+      - name: Upload schema diff artifact for forked PRs
+        # Only run for fork PRs
+        if: always() && github.event.pull_request.head.repo.full_name != github.repository
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: schema-diff
+          path: |
+            ${{ runner.temp }}/schema_diff.md
+            ${{ runner.temp }}/pr_number
+          retention-days: 1