Post modified artifacts to PRs for review

Set up a workflow_run workflow to download PR artifacts and post a comment back to the PR which shows artifacts that may have changed, as described here: https://securitylab.github.com/research/github-actions-preventing-pwn-requests

Could either run an image diff on the rasterized artifacts compared to the base revision's artifacts, or just review which file paths were modified in the diff and include all artifacts that depend on those files. Image diff increases security risk (e.g. potential malicious image artifact could be manually generated to compromise image diff program) and is more complicated, so probably best to just filter which artifacts to post based on which file paths were modified and accept that this may include artifacts that are unchanged.

Start by reading the linked GitHub Security Lab guidance on workflow_run workflows and review the repository's existing GitHub Actions configuration, if present. Define the workflow's artifact download, PR association, changed-path filtering, and comment behavior; done means a PR receives the relevant artifacts for review without exposing the workflow to the security risks described.