ci: add cross-repo IT dispatch + merge-queue gate

Wires this repo into the proxy-based integration test infrastructure
in databricks/databricks-driver-test. Mirrors the canonical pattern
established in adbc-drivers/databricks (5-job workflow, not the
simpler ODBC variant).

How it works:

  - On a normal PR event (open / push / reopen / non-IT label) we
    post a `success` Python Proxy Tests check immediately so the
    required check doesn't block the PR. The real tests run in the
    merge queue.
  - When a maintainer adds the `integration-test` label we dispatch
    the suite as a preview — useful for catching regressions before
    merge queue time. Includes path-filter detection: if only
    docs / tests/unit / etc. changed, auto-pass instead of dispatching.
  - Pushing new commits auto-removes the label so a subsequent
    labelled run requires a fresh maintainer review.
  - On the `merge_group` event the suite runs as the real required
    gate. Only PRs whose tests dispatch (or auto-pass when no driver
    files changed) can proceed to `main`.

Security:

  - Label-gated PR preview: only maintainers can apply
    `integration-test`. Fork PRs are not auto-trusted.
  - Auto-removed on synchronize: pushing new commits clears the
    label, forcing maintainer re-review before tests re-run.
  - PR titles are sanitized before interpolation into the dispatch
    JSON payload (prevents quote/newline-based JSON injection).
  - Dispatch failures post a `failure` check-run via a separate
    public-repo App token so the gate never silently turns green
    when the dispatcher itself broke.

Operational follow-ups (outside this PR):

  1. Create the `integration-test` label in this repo (already done).
  2. Install `INTEGRATION_TEST_APP_ID` / `INTEGRATION_TEST_PRIVATE_KEY`
     secrets for the GitHub App with write access to
     databricks/databricks-driver-test.
  3. Enable merge queue on `main` branch protection AND mark
     `Python Proxy Tests` a required status check. Until this is done
     the merge-queue job is dead code and ITs run only on explicit
     label.

Addresses review comments on databricks-sql-python#799 (JSON
injection + sparse merge-queue payload) and adopts the
adbc-drivers/databricks canonical pattern wholesale.

Co-authored-by: Isaac
Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>

Author: vikrantpuppala