Fix security_gate workflow semantics for blocked external PRs

[Copilot]

Motivation

The security_gate job in the performance workflow was failing for expected blocked states on external PRs. This made the workflow report a failure even when the intended outcome was simply “do not run performance jobs until a maintainer re-approves testing”.

Technical Details

• Gate behavior

  • Treat blocked states as non-failing gate outcomes by keeping is_ok_to_test=false and exiting successfully.
  • Preserve the existing skip behavior for downstream jobs via needs.security_gate.outputs.is_ok_to_test == 'true'.

• Synchronize handling

  • Check pull_request.synchronize before label validation.
  • Remove ok-to-test, emit a warning, and stop further execution without failing the job.

• Missing approval handling

  • Replace the hard failure on missing ok-to-test with a notice-level block.
  • Keep the gate closed without marking the workflow run as failed.

if [[ "${{ github.event.action }}" == 'synchronize' ]]; then
  gh pr edit ${{ github.event.pull_request.number }} --remove-label "ok-to-test" --repo ${{ github.repository }} || true
  echo "is_ok_to_test=false" >> $GITHUB_OUTPUT
  exit 0
fi

if [[ "${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}" != "true" ]]; then
  echo "is_ok_to_test=false" >> $GITHUB_OUTPUT
  exit 0
fi

Changelog Category

Add a CHANGELOG.md entry for any option other than Not Applicable

• • Added: New functionality.
• • Changed: Changes to existing functionality.
• • Removed: Functionality or support that has been removed. (Compared to a previous release)
• • Optimized: Component performance that has been optimized or improved.
• • Resolved Issues: Known issues from a previous version that have been resolved.
• • Not Applicable: This PR is not to be included in the changelog.