ci/backport: init

Adds a GitHub workflow to create backport PRs when merged PRs have a
"backport" label.

Based on the workflow used by nixpkgs:
2566f9dc/.github/workflows/backport.yml

.github/workflows/backport.yml

@@ -0,0 +1,45 @@
+# Based on
+# https://github.com/NixOS/nixpkgs/blob/2566f9dc/.github/workflows/backport.yml
+name: Backport
+
+on:
+  pull_request_target:
+    types:
+      - closed
+      - labeled
+
+jobs:
+  backport:
+    name: Backport Pull Request
+    if: >
+      vars.CI_APP_ID
+      && github.event.pull_request.merged == true
+      && (
+        github.event.action != 'labeled'
+        || startsWith(github.event.label.name, 'backport')
+      )
+
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Create GitHub App token
+        uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.CI_APP_ID }}
+          private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Create backport PRs
+        id: backport
+        uses: korthout/backport-action@v3
+        with:
+          # See https://github.com/korthout/backport-action#inputs
+          github_token: ${{ steps.app-token.outputs.token }}
+          branch_name: backport/${target_branch}/${pull_number}
+          copy_labels_pattern: .*