Restrict cherry-pick comments to trusted users

[fallintoplace]

Summary

• require /cherry-pick issue comments to come from OWNER, MEMBER, or COLLABORATOR users
• keep the same check in the comment script as a second guard
• move workflow permissions from the workflow default to the jobs that need them

Why

The cherry-pick workflow listens to issue comments and can add labels, push backport branches, and open PRs. Before this change, any commenter could trigger the label path by starting a PR comment with /cherry-pick.

Validation

• node -c .github/scripts/add-labels-from-comment.js
• mocked unauthorized comment run returns before GitHub write calls
• git diff --check

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.