[9.18] new: dev: Enable PR-Agent reviews on merge requests

Adds a CI job that runs PR-Agent against each merge request opened from the canonical repository, posting an automated review and code-improvement suggestions as MR comments. The job is gated to same-project source branches so the OpenAI key and personal access token are not exposed to fork pipelines.

Backport of MR!12032, MR!12033 and MR!12035

Merge branch 'ondrej/add-pr-agent-9.18' into 'bind-9.18'

See merge request isc-projects/bind9!12036

.gitlab-ci.yml

@@ -2593,3 +2593,23 @@ autorebase-sub:
   <<: *autorebase
   rules:
     - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE == "pipeline" && $CI_COMMIT_REF_NAME =~ /^bind-9\.[0-9]+-sub$/ && $REBASE_ONLY == "1" && $CI_COMMIT_REF_NAME =~ $AUTOREBASED_BRANCHES'
+
+pr-agent:
+  <<: *other_checks_job
+  image:
+    name: registry.gitlab.isc.org/isc-projects/images/pr-agent:latest
+    entrypoint: [""]
+  script:
+    - cd /app
+    - export MR_URL="$CI_MERGE_REQUEST_PROJECT_URL/-/merge_requests/$CI_MERGE_REQUEST_IID"
+    - echo "MR_URL=$MR_URL"
+    - export gitlab__url="$CI_SERVER_URL"
+    - export gitlab__PERSONAL_ACCESS_TOKEN="$GITLAB_PERSONAL_ACCESS_TOKEN"
+    - export config__git_provider="gitlab"
+    - export openai__key="$OPENAI_KEY"
+    - python -m pr_agent.cli --pr_url="$MR_URL" review
+    - python -m pr_agent.cli --pr_url="$MR_URL" improve
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_PATH == $CI_PROJECT_PATH && $GITLAB_PERSONAL_ACCESS_TOKEN && $OPENAI_KEY'
+      when: manual
+    - when: never