Add reusable team-guard action and decouple it from the AI review workflow

[jolelievre]

Why

The "only members of team X may trigger this" check is now duplicated in several places: inline in three PrestaShop/PrestaShop workflows (create-build-branch, sync-from-upstream, version-branch-bootstrap) and inside the ai-guarded-review reusable workflow here. Every copy hardcodes the same curl call, and changing the guard policy means touching every repository.

What

New composite action .github/actions/team-guard usable from any workflow as a single step:

- uses: PrestaShop/.github/.github/actions/team-guard@master
  with:
    team_slug: prestashop-sa
    token: ${{ secrets.JARVIS_TOKEN }}   # needs read:org

• Fails the step (and therefore every dependent job/step) when the actor is not an active member of the team — pending invitations are rejected, a small hardening compared to the inline copies which accepted any HTTP 200.
• org defaults to the repository owner and can be overridden (needed for workflows that also run on forks/mirrors).
• actor defaults to github.actor and can be overridden (the AI review flow passes github.event.sender.login).
• require_membership: false switches to report-only mode: the step never fails and exposes an is_member output, for callers that gate jobs themselves.

ai-guarded-review.yml refactored to use the action in its check-membership job (report-only mode, since the gate job evaluates the result and manages labels). The reusable workflow's inputs, outputs and secrets are unchanged — ps_apiresources and other callers need no update.

Rollout

Once this is merged:

• Fix sync-releases workflow and guard its manual trigger docker#483 guards its manual sync-releases trigger with this action
• a PrestaShop/PrestaShop PR (to follow) replaces the three inline copies

How to test

Trigger an AI review from ps_apiresources (add the Need AI review label as a prestashop-sa member): behavior identical to before. As a non-member, the guard still removes the label and fails.