Rework approval bypass notifier to work on push events

[anuraaga]

Currently the workflow is designed to run on pull request events and requires a Slack webhook secret. Unfortunately, PRs from forks can't see the secret so this workflow always fails for them. I tend to use forks for development of owned repositories to confirm external contributor experience and noticed this. To clarify, this only results in workflow failure for the person that merges a PR (like me), not the external contributor themselves so is not as bad as it could be.

But it's not that hard to rework to fetch the PR for a merged commit, then the problem goes away and all PRs, even external, get validated.

[DMarby]

Looks fine functionally, since this assumes the push event, we'll need to update the the workflow that calls this across every single repo at the same time as merging this I guess (as they currently use the pull_request event?

May be nice to have this workflow detect and handle both, that way we can take our time rolling that change out, but just swapping them all over is fine at once also.

[anuraaga]

Thanks @DMarby great point - I forgot not all callers will be pinning the workflow hash, transparently breaking seems bad. I have added support for old and new - nothing fancy, just literally copies the old flow back in as a different job and one or the other is selected by github.event_name.