ci: add repository check to workflows using secrets

Add 'if: github.repository == "ceph/ceph-csi"' condition to workflows
that use GitHub secrets to ensure they only run in the upstream repository:

- mergify-copy-labels.yaml: Added check to job using CEPH_CSI_BOT_TOKEN
- publish-docs.yaml: Added check to deploy job using CEPH_CSI_BOT_NAME/EMAIL
- pull-request-commentor.yaml: Added check to job using CEPH_CSI_BOT_TOKEN

This prevents workflows from attempting to use secrets in forks where
they are not available, avoiding workflow failures.

Assisted-by: AskBob <askbob@ibm.com>
Signed-off-by: Niels de Vos <ndevos@ibm.com>

Author: nixpanic

.github/workflows/mergify-copy-labels.yaml

@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   mergify-merge-queue-labels-copier:
+    if: github.repository == 'ceph/ceph-csi'
     runs-on: ubuntu-latest
     steps:
       - name: Copying labels

.github/workflows/publish-docs.yaml

@@ -16,6 +16,7 @@ permissions:
 
 jobs:
   deploy:
+    if: github.repository == 'ceph/ceph-csi'
     runs-on: ubuntu-latest
     steps:
       # yamllint disable-line rule:line-length

.github/workflows/pull-request-commentor.yaml

@@ -42,6 +42,7 @@ jobs:
 
     # watch out, matrix.branch can not be used in this if-statement :-/
     if: >
+      github.repository == 'ceph/ceph-csi' &&
       (github.event.label.name == 'ok-to-test' &&
       github.event.pull_request.merged != true)