Add Build-Gate environment and checkout fix

[attiasas]

ci: add Build Gate and consolidate Frogbot workflows

Summary

Replaces the per-workflow safe to test label flow with a single maintainer-approved build-gate environment that releases the test suite for fork/PR runs. Consolidates Frogbot PR and repository scans into one workflow on Frogbot v3, and bumps actions/checkout to v7 across CI workflows.

Fixes current CI issues:

Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

Changes

• Add .github/workflows/build-gate.yml: single approval gate (build-gate environment) that calls the reusable test suite and exposes a stable build-gate-success required check
• Convert test.yml to workflow_call / workflow_dispatch only; remove push/pull_request_target + safe to test label gating and label-removal step
• Replace frogbot-scan-pull-request.yml and frogbot-scan-repository.yml with unified frogbot-scan.yml (PR, push, schedule, dispatch) using jfrog/frogbot@v3, conditional frogbot environment, and matrix/if so schedule/dispatch scan both dev/main while push/PR run a single arm
• Bump actions/checkout from v5 to v7 in analysis, embedded-jar-test, release, and test jobs; test checkouts use ref fallback, persist-credentials: false, and allow-unsafe-pr-checkout: true
• Tighten analysis pull_request types to opened, synchronize, reopened

Notes

• Branch protection should require Build Gate / build-gate-success instead of individual matrix suite checks
• Requires a GitHub Environment named build-gate with required reviewers (replaces the safe to test label workflow)
• Frogbot PR scans still use the existing frogbot environment for approval

[github-actions]

---

🐸 JFrog Frogbot