Copy release-note labels from closing issues to Terraform PRs

Terraform module release notes can only be bucketed by PR labels, but the type labels often live on the issue instead of the PR.

We saw this while testing #14 against `Azure/terraform-azurerm-avm-res-keyvault-vault`: the generated release notes correctly used `.github/release.yml`, and bot-authored maintenance PRs dropped out, but every human-authored change still landed in `Other Changes` because the merged PRs had no `Type:*` labels. The linked issues had the useful labels; they just were not propagated to the PRs before release generation.

Proposed fix: add a managed Terraform workflow that runs on `pull_request_target`, reads `closingIssuesReferences` through GitHub GraphQL, filters to release-note-relevant labels, and applies missing labels to the PR issue. The workflow should not check out PR code.

Initial label allowlist:

- `Type: Bug :bug:`
- `Type: Feature Request :heavy_plus_sign:`
- `Type: Documentation :page_facing_up:`
- `Type: CI :rocket:`
- `Type: Hygiene :broom:`
- `dependencies`
- `github_actions`
- `bug`
- `enhancement`
- `documentation`

When any label is copied, the workflow can also remove `Needs: Triage :mag:` from the PR. That keeps the existing AVM triage policy aligned with the label propagation.

This should make generated release notes from #14 useful without requiring every maintainer to remember to copy labels manually.

_Drafted by GPT-5.5._

Start with the existing .github/release.yml and the workflow configuration used for Terraform modules, then inspect issue #14 for the current release-note behavior. Implement the managed workflow without checking out pull request code, and verify that allowed labels from closing issues are copied and Needs: Triage is removed when applicable.

Written by the indexing model from the issue text.