Add protected-label authorization for /label and /remove-label

[Copilot]

This adds per-label authorization so sensitive labels cannot be added/removed by low-permission actors. Repositories can now mark labels as protected and restrict their modification to trusted repository roles.

• Config surface

  • Added protectedLabels to:
    • commands.label
    • commands.removeLabel
  • Default config now includes empty protectedLabels arrays.

• Authorization behavior

  • Label operations now gate protected labels by GitHub author_association.
  • Protected labels are only modifiable by COLLABORATOR, MEMBER, or OWNER.
  • Existing allowedLabels behavior remains intact and is evaluated alongside protected-label checks.

• Command wiring

  • Added author-association extraction from issue comments, PR bodies, and PR reviews.
  • Passed association context into labelEnabled / removeLabelEnabled checks from command handlers.

• Docs and examples

  • README now documents protectedLabels and its semantics for both label commands.

commands:
  label:
    enabled: true
    allowedLabels: [] # optional allow-list
    protectedLabels: ["status:active-incident"] # restricted to COLLABORATOR/MEMBER/OWNER
  removeLabel:
    enabled: true
    allowedLabels: []
    protectedLabels: ["status:active-incident"]

• Fixes Feature Request: protected labels #33