Using a workflow to trigger mirroring instead of a webhook allows us to reuse "Approving workflow runs from public forks" GitHub feature to somewhat protect us from malicious PRs

Small update and deps refresh

Use buildah 1.27

fix #8

Add ci