CI: remove/replace compromised actions-cool/issues-helper in auto-comment workflow

Heads-up from ASF Infra. `.github/workflows/auto-comment.yml` uses `actions-cool/issues-helper@v3`.

**What happened.** On 2026-05-18 every tag of `actions-cool/issues-helper` was repointed to an imposter commit that harvests and exfiltrates CI/CD secrets ([StepSecurity advisory](https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials)); GitHub TOS-blocked the repo on 2026-05-19, so `@v3` no longer resolves.

**No exposure here.** This workflow's last run was 2025-06-10 -- it did **not** run during the compromise window, so no secrets were exposed.

**Action needed.** The reference is dead; please remove it or swap to `actions/github-script` (always-allowed `actions/*` namespace, no allow-list change needed). Happy to send a PR. Also removed from the ASF allow list in apache/infrastructure-actions#1035.

Open .github/workflows/auto-comment.yml and inspect how actions-cool/issues-helper@v3 is used in the workflow. Remove the dead reference or replace it with actions/github-script, then validate the workflow and confirm that auto-comment still performs its intended action without the compromised dependency.

Written by the indexing model from the issue text.