Add comment commands for closing/accepting advisories

[StanFromIreland]

To start with this feature, let's add !close and !accept commands. This is a little more convenient than the current summary system, and it also lets us check whether the command issuer is a PSRT member (technically, to keep things simple, I'm just checking the author_association as all organisation members and repository owners are trusted here).

Once this is tested, we can tackle the other issues that depend on this, such as adding a command to add/remove collaborators.

And, of course, there isn't any documentation for this yet 🙃. As such, I based the design on the issue/PR comment API and some testing I did.

[sethmlarson]

High-level comment: do we remove the [ACCEPT] title hack now that we have a system that can't be controlled by reporters? Also, are we sure that MEMBER isn't an association that's afforded to all GHSA collaborators? If it is then we need to check against the PSRT members list instead.

[sethmlarson]

Is there a way we can use a sort to get the latest comment immediately? I know there aren't docs but maybe we can infer this from other APIs or cause an error intentionally to see if the error tells us what parameters are accepted?

[StanFromIreland]

I tried, but I'm afraid I couldn't find anything to work. :'-(

[StanFromIreland]

Also, are we sure that MEMBER isn't an association that's afforded to all GHSA collaborators? If it is then we need to check against the PSRT members list instead.

Yes, based on the issue docs, and testing, for example:

stan@stanlaptop:~/dev/psrt-ghsa-bot{use-new-fancy-comment-api}$ gh api repos/python/cpython/security-advisories/GHSA-9p2c-gxxv-r3qr/comments \
  --jq '.[] | "\(.user.login) \(.author_association)"'
s[CENSORED]s CONTRIBUTOR
s[CENSORED]s CONTRIBUTOR
zooba MEMBER

MEMBER is only for organisation members (as I noted in the PR description, I think that this restriction is fine, and it's not worth verifying team membership too).

[StanFromIreland]

do we remove the [ACCEPT] title hack now that we have a system that can't be controlled by reporters?

Good point, I've removed it here. Although I'm leaving the close tags for a while, we can remove them in a follow-up.