ci: license checker to safelist github actions for CLA for release PRs

[acao]

we need to add a license checker to adhere to GraphQL Foundation's approved licenses for CLA, that would make it legally safe to merge PRs created by bots.

#1806 (comment)

this should be sufficient:
https://github.com/tangro/actions-license-check

[acao]

we have this working now on every push, including push to main

https://github.com/graphql/graphiql/runs/2221695077?check_suite_focus=true

valid-url is allowlisted because it does not have a package.json license field, however the repo has a LICENCE file that is MIT

the default list is probably too permissive for our purposes?

https://github.com/google/js-green-licenses#configurations

just let me know what we need to change this list to!

[acao]

@brianwarner @caniszczyk is this sufficient enough to allow the CLA bot to safelist PRs created/modified by github actions and dependabot? Humans will still do the merge of course