[fix][CI] Fix issues with approval solution for GitHub Actions (#17723)

- The approval solution doesn't work as expected by approving the PR
  or by adding the ready-to-test label and adding a comment
  "/pulsarbot rerun-failure-checks".

- Fix the ready-to-test label check:
  - Refresh PR labels when re-running workflow
    - when re-running, the event JSON remains the same. The API
      must be used to fetch the up-to-date JSON for the PR.

- Fix the PR approval check:
  - set GITHUB_TOKEN for script so that retrieving the approval status could work
diff --git a/.github/workflows/ci-cpp-build.yaml b/.github/workflows/ci-cpp-build.yaml
index d7d6032..7a450ef 100644
--- a/.github/workflows/ci-cpp-build.yaml
+++ b/.github/workflows/ci-cpp-build.yaml
@@ -56,6 +56,9 @@
 
       - name: Check if the PR has been approved for testing
         if: ${{ steps.check_changes.outputs.docs_only != 'true' && github.repository == 'apache/pulsar' && github.event_name == 'pull_request' }}
+        env:
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           build/pulsar_ci_tool.sh check_ready_to_test
 
diff --git a/.github/workflows/ci-go-functions.yaml b/.github/workflows/ci-go-functions.yaml
index 4b8b4e1..266bfd5 100644
--- a/.github/workflows/ci-go-functions.yaml
+++ b/.github/workflows/ci-go-functions.yaml
@@ -60,6 +60,9 @@
 
       - name: Check if the PR has been approved for testing
         if: ${{ steps.check_changes.outputs.docs_only != 'true' && github.repository == 'apache/pulsar' && github.event_name == 'pull_request' }}
+        env:
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           build/pulsar_ci_tool.sh check_ready_to_test
 
diff --git a/.github/workflows/pulsar-ci-flaky.yaml b/.github/workflows/pulsar-ci-flaky.yaml
index e9150bf..03e3adf 100644
--- a/.github/workflows/pulsar-ci-flaky.yaml
+++ b/.github/workflows/pulsar-ci-flaky.yaml
@@ -62,6 +62,9 @@
 
       - name: Check if the PR has been approved for testing
         if: ${{ steps.check_changes.outputs.docs_only != 'true' && github.repository == 'apache/pulsar' && github.event_name == 'pull_request' }}
+        env:
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           build/pulsar_ci_tool.sh check_ready_to_test
 
diff --git a/.github/workflows/pulsar-ci.yaml b/.github/workflows/pulsar-ci.yaml
index 74f9300..56018ea 100644
--- a/.github/workflows/pulsar-ci.yaml
+++ b/.github/workflows/pulsar-ci.yaml
@@ -62,6 +62,9 @@
 
       - name: Check if the PR has been approved for testing
         if: ${{ steps.check_changes.outputs.docs_only != 'true' && github.repository == 'apache/pulsar' && github.event_name == 'pull_request' }}
+        env:
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           build/pulsar_ci_tool.sh check_ready_to_test
 
diff --git a/build/pulsar_ci_tool.sh b/build/pulsar_ci_tool.sh
index 512163b..37daeff 100755
--- a/build/pulsar_ci_tool.sh
+++ b/build/pulsar_ci_tool.sh
@@ -159,9 +159,22 @@
     >&2 echo "GITHUB_EVENT_PATH isn't set"
     return 1
   fi
+
+  PR_JSON=$(jq '.pull_request' "${GITHUB_EVENT_PATH}")
+
+  # when re-running, the event doesn't get updated, fetch the PR JSON
+  if [[ $GITHUB_RUN_ATTEMPT -gt 1 ]]; then
+    PR_JSON_URL=$(jq -r '.pull_request.url' "${GITHUB_EVENT_PATH}")
+    echo "Refreshing $PR_JSON_URL..."
+    PR_JSON=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" "${PR_JSON_URL}")
+  fi
+
   # check ready-to-test label
-  if jq -e '.pull_request.labels[] | .name | select(. == "ready-to-test")' "$GITHUB_EVENT_PATH" &> /dev/null; then
+  if printf "%s" "${PR_JSON}" | jq -e '.labels[] | .name | select(. == "ready-to-test")' &> /dev/null; then
+    echo "Found ready-to-test label."
     return 0
+  else
+    echo "There is no ready-to-test label on the PR."
   fi
 
   # check if the PR has been approved
@@ -179,7 +192,7 @@
   FORK_REPO_URL=$(jq -r '.pull_request.head.repo.html_url' "$GITHUB_EVENT_PATH")
   PR_BRANCH_LABEL=$(jq -r '.pull_request.head.label' "$GITHUB_EVENT_PATH")
   PR_URL=$(jq -r '.pull_request.html_url' "$GITHUB_EVENT_PATH")
-  FORK_PR_TITLE_URL_ENCODED=$(jq -r '"[run-tests] " + .pull_request.title | @uri' "$GITHUB_EVENT_PATH")
+  FORK_PR_TITLE_URL_ENCODED=$(printf "%s" "${PR_JSON}" | jq -r '"[run-tests] " + .title | @uri')
   FORK_PR_BODY_URL_ENCODED=$(jq -n -r "\"This PR is for running tests for upstream PR ${PR_URL}.\n\n<!-- Before creating this PR, please ensure that the fork $FORK_REPO_URL is up to date with https://github.com/apache/pulsar -->\" | @uri")
   >&2 tee -a "$GITHUB_STEP_SUMMARY" <<EOF