[summarize-checks] Add feature "labels with limited approvers"

Currently, any user with write access, can add or remove any label from any PR. They can also **delete** labels from the repo entirely (which removes it from **all** PRs) but this is out of scope.

One way this could be mitigated:

Create a simple config mapping labels to approved users

```
- label: ARMSignedOff
users: @foo, @bar

- label: BreakingChanges
users: @baz
```

If anyone outside the list adds the label:
1. Our automation removes it
2. any checks which consume the label, also check who added the label, and ignore if not an auth user

We need both unfortunately, because even if we do 1, there's a race condition with other checks before we can remove the label.

Another option, might be to require actual "PR approval" from an ARM reviewer, in addition to the "ARMSignedOff" label. I believe CODEOWNERS and PR approvals are easier to restrict access, compared to labels.