Support explicit secret scoping on custom jobs

[shaanmajid]

Closes #2282.

Summary

Adds github-custom-job-secrets (v0) / secrets (v1) to scope which secrets are passed to custom CI jobs, replacing the blanket secrets: inherit. Follows the pattern from github-custom-job-permissions (#1179).

• Unconfigured jobs keep secrets: inherit (preserving backwards compatibility)
• Empty list/map omits secrets: entirely
• Supports both list (["TOKEN"]) and map ({ TOKEN = "ORG_TOKEN" }) formats
• Unknown job names are rejected with a diagnostic error

[shaanmajid]

This adds unknown-job-name validation for secrets (i.e. error on typos). The existing github-custom-job-permissions doesn't have this, however. I leaned toward loud failure, since secrets feel more security-sensitive, but happy to drop the validation if you'd prefer consistency with permissions, or to add it for permissions too as a follow-up.

[shaanmajid]

Hey @mistydemeo -- no rush, but just wanted to check if you're still open to this PR. If y'all don't have the bandwidth that's no problem-- I'll go ahead and close. Thanks!