Restrict which users can add certain labels to PRs

It has been suggested to restrict which users can add certain labels to PRs. For example, some breaking change labels should only be applied by the breaking change board.

Implementation options:
- GitHub Action that triggers on pull_request:labeled event, checks user, and removes label if user is not allowed. Simpler, but could be circumvented, say if the action fails to run once when the label was added.
- GitHub Action that uses timeline events API (https://octokit.github.io/rest.js/v18/#issues-list-events-for-timeline) to block PRs, if the most recent timeline event for a label was added by a disallowed user. Slightly more complex to implement, but more reliable since it would block until it confirms the label was added by the correct user.

Start by comparing the proposed GitHub Action on the pull_request:labeled event with the timeline events API entry point linked in the issue. Define how unauthorized labels are detected, removed or blocked, and how failures are handled; the work is done when the chosen approach reliably prevents disallowed users from applying protected labels.

Written by the indexing model from the issue text.