[ci] Disallow PRs against builds branch (#32335)

Our internal build infra relies on a 1:1 mapping between `main` and the
2 build branches. Directly committing changes to those branches breaks
that infra.

Adds a simple workflow to leave a comment and decline the PR.