Add strict comment validation to avoid arbitrary code execution in benchmark workflow

[rishabh6788]

Description

The newly added benchmark-pull-request. runs when a user adds a comment on the PR. We got a security notification stating this has risk of arbitrary code execution.

Without strict validation on the comment allows any bad actor to add a comment that may have arbitrary code execution and can execute github cli commands to tamper with issues and pull requests since the token used has access to them.

Below piece of code was flagged for execution

name: Check comment format
id: check_comment
       run: |
          comment='${{ github.event.comment.body }}'
          if echo "$comment" | jq -e 'has("run-benchmark-test")'; then
            echo "Valid comment format detected, check if valid config id is provided"
            config_id=$(echo $comment | jq -r '.["run-benchmark-test"]')
            benchmark_configs=$(cat .github/benchmark-configs.json)

A user can add following comment: "run-benchmark-test"'; echo "Arbitrary code!" then the workflow run log for the step will contain the echo code.

To mitigate this risk I have rewritten the logic in javascript using script block which mitigates the risk of any arbitrary code execution.

This PR also updates event trigger for add-performance-comment workflow to pull_request_target instead of pull_request as the latter does not allow adding comment on pull requests.

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

• [ ] Functionality includes testing.
• [ ] API changes companion pull request created, if applicable.
• [ ] Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[rishabh6788]

@reta I have added some more hardening for comment validation to stop any arbitrary code execution scenario.
Please review and provide your valuable feedback to make this workflow as much secure as possible.