We are an open source project with a pipeline that requires secrets to run. I want to the ability to run the pipeline for PRs (like pass secrets to builds from forked pull requests setting would allow me to), but only if I manually approve the PR. Is that possible?