Add workflow to label pull requests

This change adds a GitHub Actions workflow to label PR's based on their
changes. The following labels will be applied to pull requests:

- `documentation` - updates to `**/*.md`
- `go` - updates to `**/*.go`
- `testing` - updates to `**/*_test.go`
- `github_actions` - updates to `.github/`
- `benchmarking` - updates to `benchmark/`
- `dependencies` - updates to `go.(mod|sum)`

Signed-off-by: Austin Vazquez <[email protected]>

Author: austinvazquez

.github/new-pull-request-labels.yml

@@ -0,0 +1,22 @@
+documentation:
+  - '**/*.md'
+
+github_actions:
+  - .github/**
+  - scripts/**
+
+go:
+  - '**/*.go'
+
+testing:
+  - integration/**
+  - '**/*_test.go'
+
+benchmarking:
+  - benchmark/**
+
+dependencies:
+  - cmd/go.mod
+  - cmd.go.sum
+  - go.mod
+  - go.sum

.github/workflows/new-pull-requests.yml

@@ -0,0 +1,27 @@
+name: "New Pull Requests"
+
+on:
+  # It is safe to use pull_request_target here because we are not checking out
+  # code from the pull request branch.
+  #
+  # See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+  pull_request_target:
+
+permissions:
+  contents: read
+
+jobs:
+  label:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-20.04
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      # Use label configuration from main instead of from the pull request branch
+      # to mitigate running untrusted workflows with write permissions.
+      - uses: actions/labeler@v5
+        with:
+          configuration-path: '.github/new-pull-request-labels.yml'
+          sync-labels: true