Add dd-octo-sts chainguard policy files

Add 5 policy files under .github/chainguard/ declaring the
issuer, subject, event, and permission constraints for every
workflow that will be migrated from secrets.GITHUB_TOKEN to
DataDog/dd-octo-sts-action.

These policies must be on the default branch before the
corresponding workflow changes can use them.

Author: lloeki

.github/chainguard/self.check-pull-request-labels.sts.yaml

@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/check-pull-request-labels\.yaml@refs/(pull/[0-9]+/merge|heads/.+)
+
+permissions:
+  issues: write
+  pull_requests: write

.github/chainguard/self.check-pull-requests.sts.yaml

@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/check-pull-requests\.yaml@refs/(pull/[0-9]+/merge|heads/.+)
+
+permissions:
+  issues: write
+  pull_requests: write

.github/chainguard/self.comment-on-submodule-update.sts.yaml

@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/comment-on-submodule-update\.yaml@refs/(pull/[0-9]+/merge|heads/.+)
+
+permissions:
+  issues: write
+  pull_requests: write

.github/chainguard/self.enforce-groovy-migration.sts.yaml

@@ -0,0 +1,12 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/enforce-groovy-migration\.yaml@refs/(pull/[0-9]+/merge|heads/.+)
+
+permissions:
+  contents: read
+  issues: write
+  pull_requests: write

.github/chainguard/self.update-issues-on-release.sts.yaml

@@ -0,0 +1,10 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: "repo:DataDog/dd-trace-java:ref:refs/(heads|tags)/.*"
+
+claim_pattern:
+  event_name: (release|workflow_dispatch)
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/update-issues-on-release\.yaml@refs/(heads/.*|tags/.*)
+
+permissions:
+  issues: write