chore(cla): add cla check action

The cla check verifies that someone contributing to a Canonical project
has signed the Canonical CLA agreement

.github/workflows/cla.yml

@@ -0,0 +1,16 @@
+name: "CLA check"
+on: [pull_request, workflow_dispatch]
+
+permissions:
+  contents: read
+
+jobs:
+  cla-check:
+    permissions:
+      pull-requests: write  # for canonical/has-signed-canonical-cla to create & update comments
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if CLA signed
+        uses: canonical/[email protected]
+        with:
+          accept-existing-contributors: true