Add @bazel-io review comment command to BCR PR reviewer (#2901)

Add a `@bazel-io review` comment command to the BCR PR reviewer. It runs
the same review as the scheduled `review_prs` job, but only for the PR
it's commented on.

`review_prs` is scheduled every 20 minutes, but GitHub doesn't honor the
schedule: in practice it runs every 3-5 hours, even though each run
takes less than 2 minutes. So PRs already approved by their module
maintainers can wait hours to be merged. With this command, anyone can
ask the bot to review and merge a PR right away.

- **Trigger:** comment exactly `@bazel-io review` on a BCR PR. It's
handled by the existing `handle_comment` action type, and BCR's
`handle_comment.yml` already runs for PR comments starting with
`@bazel-io `, so no new workflow trigger is needed.
- **Behavior:** the bot reacts 👀, waits for running `dismiss_approvals`
workflow runs (like `review_prs` does), then calls `reviewPR` for the
PR. It reacts 🚀 if the PR was merged. Otherwise it replies with the
reason: draft PR, more than 500 changed files, no module versions
modified, modules still missing maintainer approval, sensitive
`metadata.json` changes or a new module, or approved but the merge
failed (usually pending or failing presubmit checks).
- **Permissions:** anyone can use the command. It doesn't loosen any
rule: the PR is still only approved and merged when every modified
module has a maintainer approval on the current head and the required
checks pass.
- **Refactoring:** `reviewPR` now returns `{ merged, message }`, and
`runHandleComment` dispatches between `@bazel-io abandon` and `@bazel-io
review`. The scheduled `review_prs` job ignores the return value, so its
behavior is unchanged.
- **Tests:** added `index.test.js` cases for the command with a fake
octokit (merge, missing approval, merge failure, sensitive metadata,
draft, and non-matching comments).

Co-authored-by: Xùdōng Yáng <wyverald@gmail.com>