fix(OVH): harden security

[acolombier]

• Harden the .htaccess config for pull request websites to protect against server-side scripts
• Add some approval logic for low reputation accounts (first time contributors) using the preview-approved label
• Actually allow PR to deploy they environment (currently, they deploy a copy of the main branch)

[Copilot]

Pull request overview

Hardens OVH preview deployments and adds approval gating for less-trusted contributors.

Changes:

• Checks contributor trust and preview-approved status.
• Deploys the pull request’s head revision.
• Adds Apache restrictions for server-side scripts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/deploy.yml	Adds preview approval and PR-ref selection logic.
.github/workflows/ovh.yaml	Enforces approval and adds Apache hardening rules.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[acolombier]

Added a revoke logic to remove the approved deployment label upon subsequent push.