Interface to update Github actions connected repos

Context: In the past, we used to install GitHub actions in connected repos pinned to a specific version. (E.g., openfn/cli-pull-action@v1.0.0) Now we know that this creates dangerous dependencies between the GitHub actions and the CLI. Just last week, a proposed update to the CLI was blocked because it required NodeJs v24 and the old GitHub actions were stuck on v18. The parent issue is here: #4548

Problem statement: While this shouldn't happen that often, if a Lightning superuser is tasked with "managing" connections to N connected repos (we install actions, create project.yaml's , etc.) they may need the ability to modify the installed action. In this case, we need the ability to change one line of the github action in each connected repo for a given instance from openfn/cli-pull-action@v1.0.0 to openfn/cli-pull-action@v1.

Nuance: While making this work should mostly be the concern of whoever is managing the Lightning instance, an individual user might also want to update their Github actions themselves. This could be done via PR to their connected repo, or via a button on the GitHub sync page.

Since this is very much a deployment management concern, we considered doing this via iex, but we think a better approach may be to provide an interface for updating the github actions for all connected repos. This could be a new utility on the "Maintenance" page for superusers, first introduced in #4473 . (image below)

Changes proposed

1. add a button to the "sync to github" page that lets a user update the github actions in their connected repo to use a new version of openfn/cli-pull-action and openfn/cli-deploy-action.
2. add a superuser interface button to the utlis page (see adaptor refresh/icon loading PR) that allows system admins to push a refresh to all currently connected github repos/branches.
3. add a backend service that updates the github action (either for the single repo, or for all connected repos) from vX to vY by committing directly to those repos, in exactly the same way the "connect" button does when a user first sets up their repos.

The actual code of the service should mimic the logic here, but be done in elixir using all the existing tooling we have to make commits in connected repos:

For each repo in the list:
  - For both the `main` branch and the connected branch
    - List the workflow files in .github/workflows/
      - For each workflow file:                                                                                         
          - Read the file content                                                                                     
          - Replace any openfn/cli-pull-action@v1.x.x with openfn/cli-pull-action@<<NEW VERSION STRING>>
          - Replace any openfn/cli-deploy-action@v1.x.x with openfn/cli-deploy-action@<<NEW VERSION STRING>>
          - If anything changed, commit the updated file back to that branch 

To allow for maximum forward compatibility (up to a breaking change) we should set the new version string to v1

Start with the existing connect-button flow and the tooling it uses to commit files in connected repositories. Review the proposed Sync to GitHub page control and the superuser Maintenance/utils interface, then trace how connected repositories and branches are updated. Done means single-repository and all-repository actions can replace the specified action versions and commit changes to the relevant branches.