No way to test review before merging

Related: #722

The workflow intentionally fails if the file is different from the contents on the target branch (e.g. `main`). That's a good security feature, but it makes it very difficult to test changes to the review workflow:

1. open PR 1 to change the review workflow
2. merge PR 1
3. open PR 2 to test the review workflow; workflow fails
4. open PR 3 to fix the review workflow
5. merge PR 3
6. rebase PR 2 on target branch, ...

I wonder whether there's a secure way to offer an override. Some un-vetted ideas:

- Allow users to set a GitHub environment variable to the SHA of the commit you want to allow.
- Allow a list of workflow maintainers (GitHub user IDs or groups). It's important that this be sourced from the workflow definition on the target branch.