backport: set correct permissions

.github/workflows/backport.yml

@@ -1,10 +1,10 @@
 name: Backport
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
 jobs:
   backport:
-    name: Create backport PRs
+    name: Backport Pull Request
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
@@ -12,6 +12,7 @@ jobs:
         with:
           # required to find all branches
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
         # should be kept in sync with `version`
         uses: zeebe-io/backport-action@9b8949dcd4295d364b0939f07d0c7593598d26cd