Support secret inheritence `secrets: inherit` for actions

Hi,

Reusable workflow supports secrets: inherit, this allows the author of the workflow to access secrets set by the configuration without the calling workflow aware of the internals of the reusable workflow it calls. It makes it easy to maintain a changing environment in which callable workflows evolve and use more secrets.

I am aware that the initial design of actions assumed secrets are provided as environment and/or input parameters. However, both methods require the caller to be aware of the implementation of the action. For composite actions which wraps a reusable code into an action it makes it difficult to maintain as the secrets must be provided explicitly via input or via environment.

Please consider to support the secrets collection in actions as well, this will explicitly mark the secret data to be masked/encrypted, and will allow inheritance similar to reusable workflows and achieve consistency.

In short, the secrets handling in actions should be similar to the secrets handling of the workflows (input object, input mask, inherit).

Workaround

workflow

      - uses: ./.github/actions/xxx
        with:
          secrets: ${{ toJSON(secrets) }}

action.yaml

inputs: 
  secrets:
    description: 'Secrets toJSON'
<snip>
runs: 
  using: "composite"
  steps:
    - uses: xxx
      with:
        xxx: ${{ fromJSON(inputs.secrets).SECRET1 }}

Expected (Inheritance)

workflow

      - uses: ./.github/actions/xxx
        secrets: inherit

action.yaml

<snip>
runs: 
  using: "composite"
  steps:
    - uses: xxx
      with:
        xxx: ${{ secrets.SECRET1 }}

Expected (Explicit)

workflow

      - uses: ./.github/actions/xxx
        secrets:
          SECRET1: xxx

action.yaml

<snip>
secrets: 
  SECRET1:
    description: 'Secret1'
<snip>
runs: 
  using: "composite"
  steps:
    - uses: xxx
      with:
        xxx: ${{ secrets.SECRET1 }}

The issue does not name a file, test, or entry point. Start by locating the toolkit code and tests that define composite-action metadata and secret or input handling, then compare them with reusable-workflow secret behavior. Done means explicit and inherited secrets are supported consistently, masked appropriately, and covered by tests for both example forms.