chore: add conservative community moderation triage

[TonMtt]

Summary

• add a review-only GitHub Actions workflow for suspicious community activity
• score a small set of explainable metadata signals and add needs-human-review only when the threshold is reached
• never block users, close/delete content, execute contributor code, or use repository secrets
• document the security model, tuning, and a label-only rollout plan

This is the proof of concept discussed after #735, where @cevheri asked to move the proposal into a PR for discussion.

Security model

The workflow uses pull_request_target only for metadata-only triage on forked PRs. It does not check out or execute pull-request code. Permissions are limited to contents: read, issues: write, and pull-requests: write.

The default threshold is intentionally conservative and configurable with MODERATION_REVIEW_THRESHOLD. The final moderation decision always remains with a maintainer.

Testing

This change is limited to a GitHub Actions workflow and its rollout documentation. The workflow is designed to remain label-only so its first real validation can be done safely against repository activity while maintainers inspect false positives and misses.

[TonMtt]

Hi @cevheri, I opened the PR as requested.

I kept the first version intentionally conservative and review-only so we can discuss the signals, threshold, and rollout before considering any stronger moderation action.

The workflow only adds needs-human-review; it does not block users, close content, delete comments, or execute contributor code.

Happy to adjust the approach based on the patterns you've been seeing in the repository.

[cevheri]

thanks @TonMtt
I will check it,
this is an interesting aproach 👍