Reenable JMH benchmarking in a safer manner

[msridhar]

Fixes #968

The key difference is now the benchmarking job only starts when the label with the name run-benchmarks is added to a PR. According to the docs only those with triage access to the repository can add or remove a label. In contrast, anyone can comment on an issue, which made our previous technique for kick-starting the benchmarks unsafe. Before adding the run-benchmarks label, a PR should be reviewed to check for malicious code.

It is impossible to test this workflow without first merging it to the main branch. However, I did test it using a PR on my fork, and confirmed it could comment back the benchmark results like before:

https://github.com/msridhar/NullAway/pull/12

After merging this PR we'll also have to add some credentials to the main NullAway repo to make this work. But first we should review, land, and then see that it fails as expected without the credentials.

Compared to the earlier workflow file, beyond changing to use labeling, I updated the versions of some external GitHub actions we are using.

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 85.94%. Comparing base (87f16cd) to head (959446b).

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #975 +/- ## ========================================= Coverage 85.94% 85.94% Complexity 2045 2045 ========================================= Files 81 81 Lines 6761 6761 Branches 1302 1302 ========================================= Hits 5811 5811 Misses 537 537 Partials 413 413 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.