Checkout base branch to prevent PR author code injection

pull_request_review checks out the PR merge commit by default,
which means require() would load the PR author's version of
shared scripts. Explicitly checkout the base branch SHA instead.

.github/workflows/codeowner-approved-label.yml

@@ -21,8 +21,10 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' }}
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout base branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Check codeowner approval and update label
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0