chore: add guardian workflows

[dcreey]

Goal: add an org-level guardian plan/apply that runs on any repo when they change files in .github/config/ directory, plans it in the PR, and then applies it on merge.

Context: https://docs.google.com/document/d/1nJ4wKycxev8d3-FaMwiP4a3YMMVmseofJIPwbwElIaA/edit?resourcekey=0-OYMYvuqjCVlcEbRpvq4O7w&tab=t.0

NOTES:

• I suspect that this workflow will fail when set as a required org level workflow because of the on::paths setting. I suspect we cannot conditionally execute this workflow if we mark it required.
• I'm also not sure this will work at all since the apply workflow runs on::push... and the required workflows block PR context. I'm not sure we can make a required workflow run in any context except PR. I will have to test this.

[sethvargo]

Hmm - I think these should live in Guardian. Guardian is a standalone software project. Is there a reason we want to keep them separate?

[dcreey]

Hmm - I think these should live in Guardian. Guardian is a standalone software project. Is there a reason we want to keep them separate?

Because the goal is to run these workflows like lint.yml on all repos. This is a specific implementation of guardian for our purposes. The guardian repo should remain general purpose.