ci: find fork pull requests by head branch when deploying previews

[MattiasBuelens]

Summary

The first fork preview run after #871 failed in Find pull request for commit (https://github.com/THEOplayer/documentation/actions/runs/35339031902): GET /repos/{repo}/commits/{sha}/pulls returns an empty list when the commit only exists in the fork, so no pull request was found for #870.

Look up the pull request by head branch instead, and keep the same safety checks:

gh api -X GET repos/$GITHUB_REPOSITORY/pulls -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" \
  --jq '[.[] | select(.head.sha == $HEAD_SHA and .head.repo.full_name == $HEAD_REPO)] | first | .number'

HEAD_OWNER / HEAD_BRANCH come from workflow_run.head_repository.owner.login / workflow_run.head_branch. The result is still required to match the exact workflow_run.head_sha and head repository, so a fork cannot get its artifact deployed under another pull request's number. Verified the query against #870 locally: returns 870.

Link to Devin session: https://dolby.devinenterprise.com/sessions/d49785eb74de44dfbe2baeafe9b73728
Open in Devin Desktop: https://dolby.devinenterprise.com/desktop/session/d49785eb74de44dfbe2baeafe9b73728?variant=devin
Requested by: @MattiasBuelens

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring