Reenable JMH benchmarking in a safer manner

[msridhar]

Fixes #968

The key difference is now the benchmarking job only starts when the label with the name run-benchmarks is added to a PR. According to the docs only those with triage access to the repository can add or remove a label. In contrast, anyone can comment on an issue, which made our previous technique for kick-starting the benchmarks unsafe. Before adding the run-benchmarks label, a PR should be reviewed to check for malicious code.

It is impossible to test this workflow without first merging it to the main branch. However, I did test it using a PR on my fork, and confirmed it could comment back the benchmark results like before:

msridhar#12

After merging this PR we'll also have to add some credentials to the main NullAway repo to make this work. But first we should review, land, and then see that it fails as expected without the credentials.

Compared to the earlier workflow file, beyond changing to use labeling, I updated the versions of some external GitHub actions we are using.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.94%. Comparing base (87f16cd) to head (959446b).

Additional details and impacted files

@@            Coverage Diff            @@
##             master     #975   +/-   ##
=========================================
  Coverage     85.94%   85.94%           
  Complexity     2045     2045           
=========================================
  Files            81       81           
  Lines          6761     6761           
  Branches       1302     1302           
=========================================
  Hits           5811     5811           
  Misses          537      537           
  Partials        413      413           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.