Harden license-headers workflow checkout for pull_request_target

[Copilot]

The license-headers-linter job failed before linting because actions/checkout now blocks checking out fork head branches in pull_request_target workflows. This change updates the workflow to use the PR merge ref from the base repository so the job can run safely.

• What changed

  • Updated .github/workflows/license-headers.yml checkout configuration to stop targeting fork repo/head ref.
  • Switched checkout to GitHub’s synthetic PR merge ref:
    • refs/pull/${{ github.event.pull_request.number }}/merge

• Why this resolves the failure

  • Avoids unsafe fork-code checkout in trusted pull_request_target context.
  • Keeps the workflow operating on the PR content via the merge ref, allowing downstream modified-file and header checks to execute.

- uses: actions/checkout@...
  with:
    ref: refs/pull/${{ github.event.pull_request.number }}/merge