Issue-Bot: Emit GitHub Action annotation when issues are affected

[staabm]

with this PR we get a issue-bot 'pull request annotation' in the 'files changed' tab, which looks like:

this annotation is only visible when issue bot finds affected issues, otherwise no annotation is showing up.
intentionally I used a message type "notice" to get a gentle hint which distracts as less as possible.

Goal: make it more obvious when issue bot has helpful results. before this PR we sometimes missed to check the issue bot results as they are hidden deep in the github.com UI

---

triggered by a discussion in #4168 (comment)

[staabm]

@ondrejmirtes @VincentLanglet any opinion on this? is it acceptable?

if so, I would cleanup the PR and we can give it a try.
if it doesn't work we can remove the annotation just by removing the commit.. so it does not cost much to test it

[staabm]

todo: remove this debug line, which atm enforce rendering of the github action annotation message

[VincentLanglet]

Personally I like it

[ondrejmirtes]

I like it too!

The reason why it's not safe to post a comment is because the only event that has access to secrets is pull_request_target. And you can't check out the repository if you want to be safe. There's a lot of attacks possible if you do that. There's a big warning here: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target

[phpstan-bot]

This pull request has been marked as ready for review.

[staabm]

ok cool - lets give it a try then

[ondrejmirtes]

Awesome, thank you!