Automatically run PR reviewer if author is org member

[derekmisler]

Add automatic PR review for Docker employees when PRs are marked as "ready for review".

Changes

• Add pull_request_target trigger for ready_for_review and opened events
• Add new auto-review job that:
  • Checks if the PR author is a Docker org member using the GitHub API
  • Only proceeds with the review if the author is an internal employee
  • Supports fork-based workflow

How It Works

Scenario	Behavior
Docker employee opens/readies a PR	✅ Auto-review runs
External contributor opens a PR	⏭️ Skipped (not a Docker org member)
Trusted contributor comments /review	✅ Manual review runs
External contributor comments /review	❌ Blocked by cagent-action auth check

Security Considerations

• Uses pull_request_target to access secrets for fork PRs
• This is safe because review-pr only reads files for static analysis, it doesn't execute any code from the PR
• Org membership check runs before any PR code is checked out
• Requires ORG_MEMBERSHIP_TOKEN secret (classic PAT with read:org scope) (this is already set up)

[krissetto]

fairly minor, but should we consider pinning a sha here just so in case the upstream action gets compromised somehow we're not immediately affected? (same for anyone else using the action)

[derekmisler]

I thought about that, but it's our own action, so it seemed safe-ish?