CI: Add workflow to remove backport labels on merge into release branches

[IanButterworth]

Adds two actions:

Backport Label Cleanup (automatic)

When a backport PR is merged to a release branch, this workflow automatically removes the backport-X.Y label from the original PRs that were cherry-picked, and adds a comment linking to the backport PR and commit.

Backport Label Audit (manual)

A workflow_dispatch action that can scan all PRs with a backport-X.Y label and check whether they have already been cherry-picked into the release-X.Y branch. Useful for catching any PRs that were missed. Defaults to dry run mode to allow review before making changes.

---

Both should make it easier to track what has been backported and in which backport PR.

[IanButterworth]

We could try this on #4563 if you agree?
@KristofferC @DilumAluthge

[DilumAluthge]

I haven't had a chance to review the code yet, so I'll defer to you and Kristoffer, if you're interested in trying this out soon.

I will try to review the code at some point (even if it's post-merge).

[DilumAluthge]

Scoped to this repo only - All API calls use context.repo.owner/context.repo.repo, preventing cross-repo manipulation"

Small comment: As long as you're using the default GITHUB_TOKEN (and no other secrets), then IIUC there inherently is no risk of cross-repo manipulation, because IIRC GitHub only gives GITHUB_TOKEN permissions on the repo where the CI job is running.

[KristofferC]

We kind of want this for any repo that uses the backport app so I wonder if it wouldn't be easier to add the functionality directly to the backport app instead of having it as a GHA?

[IanButterworth]

Ok yeah add as a tool to Backporter and call that in the close and workflow actions

[IanButterworth]

Now uses KristofferC/Backporter#14 which has an example run