Add member update workflow

[galargh]

Summary

Adds a workflow-dispatch Update Members workflow that creates a draft PR for selected member access and optional organization membership changes in organization YAML config.

Why do you need this?

This gives org maintainers a reviewable config-change PR for removing selected members from teams and repository collaborators, with configurable retention of effective public repository access and configurable removal from org membership.

What else do we need to know?

PR access comments now include repository visibility and post-change access summary sections that distinguish members from outside collaborators; outside collaborators are non-members with direct repository access.

DRI: myself

Reviewer's Checklist

• It is clear where the request is coming from (if unsure, ask)
• All the automated checks passed
• The YAML changes reflect the summary of the request
• The Terraform plan posted as a comment reflects the summary of the request