external-plugins: add netlify-preview plugin to retry deploy previews

[Caesarsage]

Adds a new external Prow plugin, netlify-preview, that retries the
latest Netlify deploy preview for a pull request in response to chat
commands. Intended for repositories whose PR previews are built by
Netlify (initially kubernetes/website and kubernetes/contributor-site).

Design

Two commands (sign-off in #693):

• /retest — retries the latest Netlify deploy preview only when
  that preview is in error state. If it is ready, the plugin
  posts a comment pointing the user to /rebuild-preview instead.
  Avoids wasteful rebuilds of passing previews on routine /retest.
• /rebuild-preview — forces a retry regardless of the preview's
  current state, except when a build is already running
  (building / enqueued). The in-flight guard prevents maintainers
  from triggering redundant builds while one is in progress.

Per-repo site mapping

This PR adds a small configuration package that maps each repository
to a Netlify site ID (This is assuming one Netlify for all related netlify projects, hence a single PAT):

repos:
  kubernetes/website:
    site_id: <netlify-site-id>
  kubernetes/contributor-site:
    site_id: <netlify-site-id>

Each repo can map to a different Netlify site independently. The
external_plugins: block in Prow configuration is only the enablement
mechanism; site mapping never goes there.

Trust gating

Retries are gated by the same trust rules Prow's trigger plugin
applies (org membership, configured trusted apps and orgs, or
/ok-to-test on the PR). The gate is a build-minute / abuse
protection rather than a code-execution protection, Netlify has
already built the commit once, so a retry does not grant new code
execution. Wasted Netlify build minutes are the real risk.

Assisted by Claude

Closes #693.

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[netlify]

✅ Deploy Preview for k8s-prow ready!

Name	Link
🔨 Latest commit	35fd839
🔍 Latest deploy log	https://app.netlify.com/projects/k8s-prow/deploys/6a1bae65b56f530008cc14ef
😎 Deploy Preview	https://deploy-preview-708--k8s-prow.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Caesarsage
Once this PR has been reviewed and has the lgtm label, please assign droslean for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Caesarsage]

I also tested locally against the real Netlify API and the real GitHub API,
with phony delivering issue_comment webhook events:
Caesarsage/website#5

Decision branches verified end-to-end:

• /retest on a ready preview: refused, points to /rebuild-preview
• /rebuild-preview on a ready preview: retried, comment posted
• /rebuild-preview while a build is in progress: refused (no retry call made)
• /rebuild-preview for a repo with no site mapping: refused with config-error message
• Comment from the bot user: event skipped silently

[Caesarsage]

cc @petr-muller @smg247

[lmktfy]

I agree with the intent of this PR.

[singh1203]

Nit: type name Config & Repo is a bit misleading wrapper.
maybe:

Suggested change

	type Config struct {
	Repos map[string]Repo `json:"repos,omitempty"`
	}
	type Repo struct {
	SiteID string `json:"site_id,omitempty"`
	}
	type SiteConfig struct {
	SiteID string `json:"site_id,omitempty"`
	}
	type Config struct {
	Repos map[string]SiteConfig `json:"repos,omitempty"`
	}

[Caesarsage]

Config is the configuration wrapper to the repository and each repository mapped to their netlify site id.

such as:

repos:
  kubernetes/website:
    site_id: <netlify-site-id>
  kubernetes/contributor-site:
    site_id: <netlify-site-id>

[Caesarsage]

/retest

[Caesarsage]

cc @stmcginnis

Could you help take a look