[pjhartlieb]

Replaces the inline copy of the CLA action with the shared workflow, release-workflows v1.3.0. The check is now named cla / CLAAssistant (was CLAAssistant; required nowhere).

• Signatures save again, on CLA's bot-only signatures branch. None have saved since 10-27: CLA main refuses the bot's push.
• Who signs: on a pull request opened by an org member or named bot, other members and bots are exempt; on one opened by anyone else, the opener and every commit author sign, members included.
• The App token is minted only for pull request events and sign/recheck comments, and only for the CLA repository.
• Fails for a maintainer to handle, instead of passing, when the commits can't all be read or a commit's author has no GitHub login.

Details: blacklanternsecurity/release-workflows#18 and #20.