.github/workflows: check external PR author perms and manage CI approval labels

.github/workflows: check external PR author perms and manage CI approval labels

Add a GitHub Actions workflow (`author-ci-perms.yml`) that triggers on PR
creation, updates, and re-openings (`opened`, `synchronize`, `reopened`) to
check if the author has collaborator permissions on the repository.

If the author's permission level is 'none' (external contributor):
- Attach the `needs-ci-approval` label to signal required review.
- Revoke existing approval by removing `ci-approved` on new pushes/updates.
- Comment on initial PR creation explaining that a Ceph org member must
  add the `ci-approved` label before CI will run.

Assisted-by: Gemini
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>