Add CLA Verification Worflow

[nlordell]

This PR adds a workflow for verifying CLA signatures for external contributors.

I detailed the steps for integrating here for other projects to use.

Basically, this workflow will first:

• Fetch the collaborators (AFAICT team members that we have added to the repo) with the GitHub API.
• Add them and *[bot] to the list of "allowed" GitHub users that don't need to sign the CLA.
• Use the contributor-assistant/github-action action to verify the CLA is signed. I used this action as it seemed to be, by far, the most popular one in the market place and keeps the signature file in-tree.

Test Plan

Checkout the CLA file that was created. It turns out that the pull_request_target triggers, the GitHub action needs to be in main, so the bot will be enabled after this is already merged. I tested it in a repo before creating this PR here: https://github.com/cowprotocol/cla-test.

Also, if someone has a non-member account after this is merged (maybe @e00E), can they create a PR and check that the CLA bot flags it as CLA needed?

[nlordell]

recheck

[codecov-commenter]

Codecov Report

Merging #169 (1ac2569) into main (f203851) will increase coverage by 0.02%.
The diff coverage is n/a.

❗ Current head 1ac2569 differs from pull request most recent head 67cccb2. Consider uploading reports for the commit 67cccb2 to get more accurate results

@@            Coverage Diff             @@
##             main     #169      +/-   ##
==========================================
+ Coverage   64.80%   64.83%   +0.02%     
==========================================
  Files         185      185              
  Lines       38398    38388      -10     
==========================================
+ Hits        24884    24889       +5     
+ Misses      13514    13499      -15     

[josojo]

Thanks Nick. Pr looks good.

Just FYI: I thought I would have merged the external contribution from here: #162
but actually, it was not yet merged. That means we don't need a custom text for them to sign. All good.

[MartinquaXD]

Thanks for setting this up!
LGTM.
I'm a little confused about the purpose of recheck if the bot also gets triggered when someone comments the magic words.
When would somebody use recheck?

[nlordell]

When would somebody use recheck?

Good question. This is mostly an artifact from copying the setup from https://github.com/contributor-assistant/github-action, but one case where it would be useful is if you have someone make a PR, then added to the team (making them exempt from CLA signing), then recheck would re-run the check making them not need to sign the CLA (at least in principle).