Update workflow for PRs to require safe-to-test label to run BrowserStack tests

.github/workflows/github_actions.yml

@@ -2,18 +2,34 @@ name: 'BrowserStack Test'
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
     branches: [ master ]
 
 jobs:    
   ubuntu-job:
     name: 'BrowserStack Test on Ubuntu'
+    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
     runs-on: ubuntu-latest  # Can be self-hosted runner also
+    permissions:
+      contents: read
+      pull-requests: write
     environment:
       name: Integrate Pull Request
     env: 
       GITACTIONS: true
     steps:
 
+      - name: 'Remove safe-to-test label'
+        uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.removeLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              name: 'safe-to-test'
+            })
+
       - name: 'BrowserStack Env Setup'  # Invokes the setup-env action
         uses: browserstack/github-actions/setup-env@master
         with: