Populate a label picker from openshift/release _labels.yaml

## Summary

`_labels.yaml` in `openshift/release` (`core-services/prow/02_config/_labels.yaml`) lists the labels Prow accepts, split into `additional_labels` (anyone may set) and `restricted_labels` (gated on specific GitHub teams). The extension does not read it.

Today `/label` and `/remove-label` are all-or-nothing: the `label` plugin is either enabled for a repo or not, and the user types the label name by hand. #137 adds ten hardcoded one-click buttons for common OpenShift gating labels, which covers the frequent cases but not the long tail.

## Proposal

Fetch and parse `_labels.yaml` in the background worker (same pattern and TTL cache as the existing plugin config fetch), then use it to populate a label picker for `/label` and `/remove-label`, following the branch picker added for `/cherry-pick`.

Worth carrying through to the UI: `restricted_labels` name the team that may apply them, so the picker can show that per entry rather than letting users post a command Prow will reject.

## Context

Split out of #132, where plugin-config fetching, per-repo parsing, button filtering and caching are all implemented. This is the one piece of that issue's first bullet that is a genuinely different feature — populating a picker rather than gating a button.

> [!Note]
> Responses generated with Claude

Start by tracing the existing plugin-config fetch and TTL cache in the background worker, then compare it with the branch picker for `/cherry-pick`. Implement the picker for `/label` and `/remove-label` using `core-services/prow/02_config/_labels.yaml`, showing restricted-label teams and preserving the existing cache pattern.

Written by the indexing model from the issue text.