Fix/gate cuda ci registry auth (#33376)
This pull request updates the GitHub Actions workflows to improve
security when handling pull requests from forks. The main change is to
ensure that jobs running on self-hosted runners with managed identities
only execute trusted code from the main repository, preventing untrusted
fork code from gaining elevated permissions.
Security improvements for workflow jobs:
* Updated the `build-linux-cuda-x64-release` and
`test-linux-cuda-x64-release` jobs in
`.github/workflows/linux_cuda_ci.yml` to only run on self-hosted runners
if the pull request comes from the main repository, and moved job-level
permissions under this condition.
[[1]](diffhunk://#diff-04806013a5e7991ba5606145885d9b0fcd99a7df1f3bb96a2d38fc724ccd9b2aL16-R26)
[[2]](diffhunk://#diff-04806013a5e7991ba5606145885d9b0fcd99a7df1f3bb96a2d38fc724ccd9b2aR61)
* Added a similar conditional check to the `build_test_pipeline` job in
`.github/workflows/reusable_linux_build.yml` to prevent fork-controlled
code from running on self-hosted runners with managed identities.
