Add github action to protect released changelog

Author: XSAM

.github/workflows/protect-released-changelog.yml

@@ -0,0 +1,20 @@
+# This action against that any PR targeting the main branch touches released
+# sections in CHANGELOG file. If change to released CHANGELOG is required, like
+# doing a release, add the \"Unlock Released Changelog\" label to disable this action.
+
+name: Protect released changelog
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+jobs:
+  protect-released-changelog:
+    runs-on: ubuntu-latest
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'Unlock Released Changelog')}}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Protect the released changelog
+        run: |
+          ./tools/verify_released_changelog.sh ${{ github.base_ref }}