Add GitHub Action for Tor update check

[eloquence]

Status

Ready for review

Refs freedomofpress/securedrop-builder#482

The new-tor-issue script and parts of the job code were imported from the securedrop-builder repo and authored by Kunal Mehta, see freedomofpress/securedrop-builder#408 and freedomofpress/securedrop-builder#287

Description of changes

Migrate logic for checking for and applying Tor updates to GitHub Actions

[eloquence]

I think this is ready for a review pass. What I've tested:

• automatic issue creation (to a sandbox repo, via a test token that's now revoked)
• automatic pushes (to a test branch, via the existing PUSH_TOKEN)

A new ISSUE_TOKEN with access to the securedrop repo has been configured but it has not been used yet.

Using both tokens in the same job seems to work fine, since ISSUE_TOKEN is only needed for the gh commands, which use the distinct GH_TOKEN variable.

I've not tested the actual reprepo behavior aside for looking out for errors in the job output. Here's an example run:

https://github.com/freedomofpress/securedrop-apt-test/actions/runs/8430760453/job/23087122497?pr=221

I'm happy to help with any additional pre-merge testing. freedomofpress/securedrop-builder#493 removes the corresponding CircleCI logic in securedrop-builder once this one is ready (marked draft for now to avoid accidental merge).

[legoktm]

Overall this looks good, I think the testing you've done is sufficient to land this, if there's an issue with permissions or whatever we can fix it iteratively.

[legoktm]

Awesome, thanks :D