[6.0.x] Configured dangerous-triggers zizmor rule.

Backport of 846613e521 from main.

.github/workflows/labels.yml

@@ -3,6 +3,8 @@ name: Labels
 on:
   pull_request_target:
     types: [ edited, opened, reopened, ready_for_review ]
+    branches:
+      - main
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/new_contributor_pr.yml

@@ -3,12 +3,16 @@ name: New contributor message
 on:
   pull_request_target:
     types: [opened]
+    branches:
+      - main
 
 permissions:
   pull-requests: write
 
 jobs:
   build:
+    # Only trigger on the main Django repository
+    if: github.repository == 'django/django'
     name: Hello new contributor
     runs-on: ubuntu-latest
     steps:

zizmor.yml

@@ -1,4 +1,8 @@
 rules:
+  dangerous-triggers:
+    ignore:
+      - labels.yml
+      - new_contributor_pr.yml
   unpinned-uses:
     config:
       policies: