Managed repositories run only allow-listed actions

## Summary

Narrow the `github_repository` module's `allowed_actions` from `all` to
`selected`, backed by an allow-list of GitHub-owned actions, verified
Marketplace creators, and explicit patterns for the rest.

## Motivation

PR #372 set `allowed_actions = "all"` in the module. That value was chosen
defensively rather than as policy: the provider assigns the field on every
write whenever Actions are enabled, and `encoding/json` drops a pointer field
only when the pointer is nil, so leaving it unset puts an empty string on the
wire instead of omitting it. `all` matched what all eleven managed
repositories already reported, so it codified the status quo.

It is still the most permissive value on that axis — any action from anywhere
on GitHub may run. SHA pinning, which also landed in #372, constrains *how* an
action is referenced but not *which* actions may be referenced at all.

## Scope

- Set `allowed_actions = "selected"` with an `allowed_actions_config` block
(`github_owned_allowed`, `verified_allowed`, `patterns_allowed`).
- Work through the third-party actions currently in use and decide which are
covered by `verified_allowed` and which need an explicit pattern. As of
filing, 22 distinct third-party actions across 10 orgs:
`8c6794b6/hpc-codecov-action`, `amannn/action-semantic-pull-request`,
`bats-core/bats-action`, `benchmark-action/github-action-benchmark`,
`codecov/codecov-action`, `codecov/test-results-action`,
`extractions/setup-just`, `google-github-actions/auth`,
`google-github-actions/setup-gcloud`, `hashicorp/setup-terraform`,
`haskell-actions/hlint-setup`, `haskell-actions/setup`,
`JasonEtco/create-an-issue`, `lycheeverse/lychee-action`,
`nomeata/haskell-bounds-bump-action`, `peter-evans/create-issue-from-file`,
`pnpm/action-setup`, `pre-commit/action`, `reviewdog/action-setup`,
`withastro/action`.
- Decide whether the allow-list is uniform across the baseline or a module
variable, since repos draw on different action sets.

## Acceptance criteria

- [ ] Module sets `allowed_actions = "selected"` with an allow-list.
- [ ] Every workflow across the managed repos still resolves its actions.
- [ ] `terraform plan` shows the change with no workflow regressions.

## Additional context

Weigh the ongoing cost before starting: once the list is closed, a new
third-party action must be added to it before its workflow will run. Renovate
does not absorb that — it bumps actions already listed, it does not introduce
new ones. The failure mode is a red check on an unrelated PR whose cause is a
Terraform file in another repo.

Setting this also means Terraform owns the field, so a narrower policy set by
hand in the UI is reverted on the next apply.