x/build: apply Hold+1 to any CL with mismatch between target branch and subject prefix

[dmitshur]

When working on branches other than the main one, or making cherry-pick CLs, we have a convention of putting the branch name in square brackets before the subject.

From https://golang.org/wiki/MinorReleases:

The cherry-pick CL must include a message prefix like [release-branch.go1.10]

If there is a mismatch between the actual target branch of the CL and what the prefix says, we should have some automated mechanism to prevent accidental submission.

This could've helped catch:

• all: reset master to remove accidental merge CL #41718, where the CL subject correctly indicated the intended branch as "[dev.link]"
• x/tools: rewrite git history to remove accidental merge commit #43628, where the CL subject correctly indicated the intended branch as "[gopls-release-branch.0.6]"
• https://go.dev/cl/405543, which did not have "[release-branch.go1.18]" prefix

Perhaps it can be implemented as gopherbot applying a -2 code review vote (and a comment?), or some other way. This is closely related to #10658, which is about detecting large binaries, and to #18548, which is about various server-side checks.

/cc @golang/osp-team @cherrymui @jeremyfaller