[improve][ci] Check ASF action allowlist in preconditions

[lhotari]

Motivation

Action refs that are no longer on the ASF allowlist can cause GitHub Actions startup failures. Scan the repository's GitHub Actions configuration against the current allowlist and surface warnings for approved pins approaching expiry.

Modifications

Add apache/infrastructure-actions/allowlist-check at @main immediately after checkout in the existing preconditions job. The action scans YAML files for uses: references and checks them against ASF's current approved allowlist, failing CI for unapproved action references. It also emits non-failing warnings when an approved pin expires within 30 days, giving advance notice to update it before approval expires. Use .github/**/*.y*ml to scan both .yml and .yaml files, including local action definitions.

Run the check only when the pull request's base repository belongs to apache, falling back to the current repository owner for scheduled and manual runs. Make checkout unconditional so those runs also have the files available to scan.

Verifying this change

• Make sure that the change passes the CI checks.

This change adds CI configuration without application tests.

• Verified that the glob matches all 23 YAML files under .github, including all nine .yaml files.
• git diff --check passes.
• actionlint -shellcheck='' reports no new diagnostics relative to the existing six matrix-property errors.
• ./gradlew spotlessCheck checkstyleMain checkstyleTest passes.
• Reviewed in difit and incorporated feedback to skip non-Apache base repositories.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Adds the ASF allowlist-check CI action.