chore: create workflow to check the do-not-merge label (#3213)

We have the label, but it doesn't do anything. Add a workflow that can
check it, to
be added as a required status check.

.github/workflows/check_do_not_merge_label.yml

diff --git a/.github/workflows/check_do_not_merge_label.yml b/.github/workflows/check_do_not_merge_label.yml
new file mode 100644
index 0000000..97b91b1
--- /dev/null
+++ b/.github/workflows/check_do_not_merge_label.yml
@@ -0,0 +1,20 @@
+name: "Check 'do not merge' label"
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+
+jobs:
+  block-do-not-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for "do not merge" label
+        if: "contains(github.event.pull_request.labels.*.name, 'do not merge')"
+        run: |
+          echo "This PR has the 'do not merge' label and cannot be merged."
+          exit 1