Add issue deduplicator workflow (#4628)

It's a bit hand-holdy in that it pre-downloads issue list but that keeps
codex running in read-only no-network mode.

.github/workflows/issue-labeler.yml

@@ -28,6 +28,7 @@ jobs:
         with:
           openai_api_key: ${{ secrets.CODEX_OPENAI_API_KEY }}
           prompt_file: .github/prompts/issue-labeler.txt
+          require_repo_write: false
 
   apply-labels:
     name: Apply labels from Codex output