fix(ci): Add secure PR labeler workflow with v5 config

[Copilot]

Overview

Implements an automated PR labeling workflow using GitHub Actions, based on the approach in PanagiotisDrakatos/HCE_v33_final_allinone_ready#32, with critical security fixes and improvements.

Changes

• .github/labeler.yml: Labeler configuration using actions/labeler@v5 schema with array matchers
• .github/workflows/pr-labeler.yml: GitHub Actions workflow for automatic PR labeling
• .github/README.md: Documentation explaining security considerations and available labels

Security Improvements

This implementation addresses several security concerns identified in the original PR:

1. Event Type: pull_request instead of pull_request_target

The original implementation used pull_request_target with explicit checkout of PR code, which creates a security vulnerability:

# ❌ Original (insecure)
on:
  pull_request_target:
    types: [opened, synchronize, reopened, ready_for_review]
steps:
  - uses: actions/checkout@v4
    with:
      ref: ${{ github.event.pull_request.head.sha }}

This allows malicious PRs to execute untrusted code with write permissions and access to repository secrets.

Our implementation uses the safer pull_request event:

# ✅ Our implementation (secure)
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
steps:
  - uses: actions/checkout@v4

Benefit: The workflow runs in the context of the merge commit with restricted permissions, preventing malicious code execution.

2. Fork Compatibility

The original checkout configuration would fail for forked PRs because github.event.pull_request.head.sha doesn't exist in the base repository. Our implementation works seamlessly with both same-repo and forked PRs.

3. Code Documentation

Added inline comment explaining the 200-line debug output limit to avoid confusion about the "magic number":

# Print only the first 200 lines to avoid log overflow in CI output
sed -n '1,200p' .github/labeler.yml

Available Labels

The workflow automatically applies labels based on changed files:

• Module labels: api, bloom-filter, config, consensus, core, crypto, distributed-ledger, erasure-code, network, protocol, shared-resources, trie, util
• Functional labels: documentation, ci, docker, build, tests

Testing

YAML syntax validated successfully:

labeler.yml: Valid YAML ✓
pr-labeler.yml: Valid YAML ✓

The workflow will automatically run on all PRs (opened, synchronized, reopened, or marked ready for review) and apply appropriate labels based on the files changed.

Original prompt

@PanagiotisDrakatos/HCE_v33_final_allinone_ready/pull/32

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.