[chore] Add CI check to enforce merge freeze during release (#37097)

#### Description

As stated in the [Release Procedure
document](https://github.com/open-telemetry/opentelemetry-collector/blob/main/docs/release.md#releasing-opentelemetry-collector-contrib),
all merging in Contrib should be halted while the "Prepare release" PR
is open. This PR adds a CI check which fails if such a release PR is
currently open.

This is the same as the CI check introduced in Core as part of [this
issue](open-telemetry/opentelemetry-collector#11707)
([Initial
PR](open-telemetry/opentelemetry-collector#11744),
[bug](open-telemetry/opentelemetry-collector#11808),
[fix](open-telemetry/opentelemetry-collector#11849),
[bug
2](open-telemetry/opentelemetry-collector#11906),
[fix
2](open-telemetry/opentelemetry-collector#11936),
[fix
3](open-telemetry/opentelemetry-collector#12045),
[fix
4](open-telemetry/opentelemetry-collector#12051)).

Like its predecessor, this will only be fully effective once the merge
queue is enabled on this repo (see #36788 for progress on that),
enabling us to do proper last-minute checks instead of relying on the
freeze status at the time of the latest PR update. Similarly, for proper
enforcement, this check will need to be marked as required in the main
branch protections (I will create an issue on the community repo to that
effect once this PR is merged).

#### Link to tracking issue

Updates #36848

#### Testing

Considering the multiple iterations this code went through on Core, it
should now work properly without adaptation.

However, considering the multiple iterations this code went through on
Core, we should expect the unexpected, especially when it comes to the
interaction with the merge queue, so release managers will need to be
aware of this change, in case it breaks the release process.

---------

Co-authored-by: Pablo Baeyens <[email protected]>
Co-authored-by: Moritz Wiesinger <[email protected]>

.github/workflows/check-merge-freeze.yml

@@ -0,0 +1,34 @@
+name: Merge freeze
+
+on:
+  pull_request:
+    types:
+      - opened
+      - ready_for_review
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+      - enqueued
+    branches: [main]
+  merge_group:
+    types: [checks_requested]
+
+permissions: read-all
+
+jobs:
+  check-merge-freeze:
+    name: Check
+    # This condition is to avoid blocking the PR causing the freeze in the first place.
+    if: |
+      (!startsWith(github.event.pull_request.title || github.event.merge_group.head_commit.message, '[chore] Prepare release')) ||
+      (!(github.event.pull_request.user.login == 'opentelemetrybot' || github.event.merge_group.head_commit.author.name == 'OpenTelemetry Bot'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/workflows/scripts
+      - run: ./.github/workflows/scripts/check-merge-freeze.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: open-telemetry/opentelemetry-collector-contrib

.github/workflows/scripts/check-merge-freeze.sh

@@ -0,0 +1,11 @@
+#!/bin/bash -e
+#
+# Copyright The OpenTelemetry Authors
+# SPDX-License-Identifier: Apache-2.0
+
+BLOCKERS=$( gh pr list -A opentelemetrybot -S "[chore] Prepare release" --json url -q '.[].url' -R "${REPO}" )
+if [ "${BLOCKERS}" != "" ]; then
+    echo "Merging in main is frozen, as there are open \"Prepare release\" PRs: ${BLOCKERS}"
+    echo "If you believe this is no longer true, re-run this job to unblock your PR."
+    exit 1
+fi