Metrics bot uses wrong branch

[bird-dancer]

The metrics bot runs on: [pull_request_target] meaning it operates on the target ie. master branch not on the branch requesting to be pulled.
For example: In this pr: #80 there are two commits. One that doesn't influence metrics at all and one that yields an error rate of 100% but the bot comments the same error rate of 15% on both.
So the metrics should either be done on push, on pull_request with some setup not requiring access to secrets, or remain on pull_request_target but explicitly checkout the pr branch after human approval.

[cwerling]

Thanks for spotting this! I chose to allow all pull_requsts to access the fixtures repo through this.