fix(workflows): allow github CDN egress in recompile-safe-output-fixtures

[jamesadevine]

Summary

Adds the github ecosystem identifier to network.allowed in the recompile-safe-output-fixtures workflow.

The workflow's Step 2 downloads ado-aw-linux-x64 and checksums.txt from a GitHub Release. Those URLs return a 302 redirect to release-assets.githubusercontent.com, which is not covered by the defaults ecosystem — it's covered by github (per gh-aw network reference).

Without the github ecosystem listed, AWF blocks the redirected CDN host and the agent silently loops through all 12 retry attempts (~6 minutes) before aborting — observed on run 27019604536.

Change

 network:
-  allowed: [defaults, dev.azure.com, learn.microsoft.com]
+  allowed: [defaults, github, dev.azure.com, learn.microsoft.com]

This is the only workflow in the repo that performs direct asset downloads via curl from a GitHub Release (the others use gh API calls, which already work). So no other workflow needs the same change.

Test plan

• gh aw compile recompile-safe-output-fixtures regenerated the lock file cleanly.
• After merge: trigger via workflow_dispatch against tag v0.31.1 and confirm Step 2 succeeds without retry loop, Step 3 produces a non-empty diff (current tests/safe-outputs/*.lock.yml files are stamped with an older compiler version), and the PR is opened with the expected title.