Fix artifact poisoning risk in sonarcloud-analysis workflow

[noraeb]

Summary
Two related security issues exist in .github/workflows/sonarcloud-analysis.yml.

1. dawidd6/action-download-artifact is pinned to v5, which is vulnerable to artifact poisoning via forks (Dependabot alert, patched in v6)
2. The SonarCloud build and analysis steps use the pull_request_target trigger, which runs in a privileged context and should not be combined with externally-sourced artifacts

What to do

1. Upgrade action-download-artifact to v6
2. Replace pull_request_target with pull_request (see for example https://github.com/com-pas/compas-cim-mapping)

Acceptance criteria

• action-download-artifact upgraded to v6 or later
• Trigger changed from pull_request_target to pull_request
• Dependabot alert resolved
• SonarCloud analysis still passes on PRs