Block pull request jobs on "CLA: yes" label

I think this is a better UX than the old "Every single time a Googler has to click the button" workflow.

For a pull request, we should be able to just get the labels and wait until "CLA: yes" shows up, then unblock the job.

The issue names no files, tests, or entry points. Start by locating the pull request job configuration and the code that reads pull request labels, then verify how the existing manual workflow is triggered. Done means the job remains blocked until the "CLA: yes" label appears.

Written by the indexing model from the issue text.