DTOSS-12521: skip deploy stage on PRs without deploy label

  Dependabot PRs do not have access to repository secrets by design,
  causing the deploy stage to fail on Azure login. Gate deploy-stage
  behind the deploy label, consistent with deploy-app-stage and the
  approach used in dtos-manage-breast-screening.

Author: josielsouzanordcloud

.github/workflows/cicd-1-pull-request.yaml

@@ -27,6 +27,7 @@ jobs:
   deploy-stage:
     name: Deploy stage
     needs: [commit-stage, test-stage]
+    if: contains(github.event.pull_request.labels.*.name, 'deploy')
     permissions:
       id-token: write
     uses: ./.github/workflows/stage-4-deploy.yaml