Consider allowing CI to always run the private layer

# Description of feature
I think it's helpful to enable the private layer on all CI, even when PRs are opened by non-lab members. To prevent malicious access, we can set GHA to only run for collaborators after manual approval from a reviewer.
