CI: allow PRs to access binary for checking

.github/workflows/compile-check.yml

@@ -1,5 +1,11 @@
 name: Compile and verify functions
-on: [push, pull_request]
+on:
+  push:
+  pull_request_target:
+    types: [opened, synchronize]
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
   compile_verify:
@@ -9,6 +15,12 @@ jobs:
       uses: actions/checkout@v3
       with:
         submodules: recursive
+    - name: Check out branch if in PR
+      if: ${{ github.event_name == 'pull_request_target' }}
+      uses: actions/checkout@v3
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        submodules: recursive
     - name: Check for W-state functions
       run: |
         if grep -q ",W," "data/odyssey_functions.csv"; then