[llvm] Reapply [workflows] Split pr-code-format into two parts to make it more secure (#78215) (PR #80495)

[Tom Stellard via llvm-commits]

tstellar wrote:

> Wouldn't any PR that has an updated version of `.github/works/pr-code-format.yml` (so is actually running the code formatting job) also have an updated version of the python script, assuming they were both modified in the same commit?

My guess is that since the older branches had the pull_request_target version of the workflow that caused GitHub Actions to pull the workflow file from main.

https://github.com/llvm/llvm-project/pull/80495