Adds an "external approval required" trust policy for GitHub fork pull requests: a fork PR is discovered but its job stays disabled until someone approves it.