Add per-command org-member permissions

[Copilot]

This adds optional command-level permission controls so repositories can restrict specific comment-ops commands to organization members. By default, commands remain open to all commenters, preserving current behavior.

• Per-command permission model

  • Add permission to each command config
  • Support:
    • all (default): any commenter may invoke the command
    • member: only org MEMBER and OWNER authors may invoke the command

• Authorization enforcement

  • Extend command enablement checks to evaluate the comment/review author's GitHub author_association
  • Apply permission checks consistently across all supported commands:
    • close
    • reopen
    • label
    • remove-label
    • reviewer
    • transfer

• Config and docs

  • Update default config to include permission: all
  • Document the new option in the README with supported values and behavior

• Test coverage

  • Add focused tests for:
    • default behavior when permission is unset
    • member access for org members/owners
    • denial for non-members
    • extraction of author association from webhook payloads

Example configuration:

commands:
  label:
    enabled: true
    permission: member
    allowedLabels: [bug, chore, enhancement]

  close:
    enabled: true
    permission: all

• Fixes Allow restricting to org members #10