Guard CI secrets for forked PRs

Author: kvz

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
       - synchronize
 jobs:
   ci:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     strategy:
       fail-fast: true