This PR updates our github workflows so that we have higher rate limits without exposing the repository to secrets vulnerabilities. Here's what I've done:

• Created a PAT that is read-only for public repositories and added it in a "github environment' called pr-tests
• Moved our PyPI publishing PAT to another environment called pypi-publish.
• Updated our tests workflow to run pull_request_target so that the tests PAT is available
• Use that PAT so we have a higher rate limit and don't hit it as easily.
• Adds some documentation about this.

I'll make a release soon to see if this fixes things.