Avoid accidentally changing remote-config and ansible vars in same PR

[timmc-edx]

Add a CI check in edx-internal and edge-internal to keep people from accidentally changing remote-config and Ansible vars in the same PR, since this has caused a number of production incidents in the past.

Acceptance criteria:

• A PR that tries to change both directories gets a failing CI check
• The check is marked as required (blocking merge when it fails)
• Workflow logs a helpful error message explaining the reasoning
  • Optional: Present the error message as a comment using gh cli
• Copy to edge-internal once we've validated it on edx-internal
• Optional: If it's really simple, allow bypassing the restriction via a special label. (This is a little tricky because you'd need a way to rerun the check if the label is added afterwards. Maybe not automated, but require devs to ask GH to re-run the check?)