Rename workflow files from .yaml to .yml for consistency and compatibility with the new asf-allowlist-check.yml workflow

Author: jacopoc

.github/README-CI-CD.md

@@ -2,15 +2,15 @@
 
 ## Workflows
 
-- `gradle.yaml`  
+- `gradle.yml`  
   Build and checks (style, Javadoc)  
   → Trigger: push / PR on `trunk` and `release*`
 
 - `codeql-analysis.yml`  
   Security analysis (Java + JavaScript)  
   → Trigger: push / PR + weekly on `trunk` and `release*`
 
-- `docker-image.yaml`  
+- `docker-image.yml`  
   Build and push images to `ghcr.io/apache/ofbiz`  
   → Trigger: push on `trunk` / `release*` + tags
 
@@ -22,6 +22,10 @@
   OpenSSF security scorecard  
   → Trigger: `trunk` + weekly
 
+- `asf-allowlist-check.yml`
+  Verifies all GitHub Actions refs are on the ASF allowlist
+  → Trigger: push / PR on `.github/` path
+
 ### Workflow behavior
 
 - `push` → uses the workflow from the target branch