workflows: Reconfigure pr-subscriber action so that it can access secrets

Secrets are not available for workflows triggered by PRs, so we need
to split the pr-subscriber action into two separate actions.  The
first will listen for new labels on PRs and the second will add
a comment with the team mention.

See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/