ci: automate backports to release branches

Label a PR 'backport <branch>' (e.g. 'backport 2.18') and, once it
merges, this workflow cherry-picks the PR's commits onto that branch
and opens the backport PR automatically. Labeling an already-merged
PR triggers it retroactively. On cherry-pick conflict the action
comments on the original PR so the backport can be done by hand.

.github/workflows/backport.yml

@@ -0,0 +1,23 @@
+name: backport
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  backport:
+    name: Backport merged PR
+    runs-on: ubuntu-latest
+    if: >
+      github.event.pull_request.merged == true &&
+      (
+        github.event.action == 'closed' ||
+        startsWith(github.event.label.name, 'backport ')
+      )
+    steps:
+      - uses: actions/checkout@v6
+      - name: Create backport pull requests
+        uses: korthout/backport-action@v3