Evaluate changelog exemption labels from live PR state (#10472)

The changelog check decided whether a PR was exempt using the labels in
the triggering event payload (github.event.pull_request.labels). That
payload is frozen at event time, so a PR that gets the
kind/changelog-not-required label after its first run could not pass by
re-running the failed job, and the exemption only took effect if a brand
new event happened to fire afterward.

Move the exemption logic into hack/changelog-check.sh and query the PR's
current labels via the GitHub API instead. Re-runs and labels added after
the initial run are now evaluated correctly. The workflow grants
pull-requests: read and passes github.token so the script can read labels.

The exempt label set (kind/changelog-not-required, Design, Website,
Documentation) is unchanged.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

.github/workflows/pr-changelog-check.yml

@@ -4,6 +4,11 @@ name: Pull Request Changelog Check
 on:
   pull_request:
     types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
 
   build:
@@ -16,5 +21,6 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Changelog check
-      if: ${{ !(contains(github.event.pull_request.labels.*.name, 'kind/changelog-not-required') || contains(github.event.pull_request.labels.*.name, 'Design') || contains(github.event.pull_request.labels.*.name, 'Website') || contains(github.event.pull_request.labels.*.name, 'Documentation'))}}
+      env:
+        GH_TOKEN: ${{ github.token }}
       run: ./hack/changelog-check.sh