Exclude forks from executing "privileged" GHA jobs on our self-hosted runners. Updates tailscale/corp#43401 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>