Fixes #968 

The key difference is now the benchmarking job only starts when the
label with the name `run-benchmarks` is added to a PR. According to [the
docs](https://docs.github.com/en/issues/using-labels-and-milestones-to-track-work/managing-labels#applying-a-label)
only those with triage access to the repository can add or remove a
label. In contrast, anyone can comment on an issue, which made our
previous technique for kick-starting the benchmarks unsafe. Before
adding the `run-benchmarks` label, a PR should be reviewed to check for
malicious code.

It is impossible to test this workflow without first merging it to the
main branch. However, I did test it using a PR on my fork, and confirmed
it could comment back the benchmark results like before:

msridhar#12

After merging this PR we'll also have to add some credentials to the
main NullAway repo to make this work. But first we should review, land,
and then see that it fails as expected without the credentials.

Compared to [the earlier workflow
file](https://github.com/uber/NullAway/blob/87ec10d4f26630d4bb91aefe5ff7c0fc181f030a/.github/workflows/jmh-benchmark.yml),
beyond changing to use labeling, I updated the versions of some external
GitHub actions we are using.