Extract the Haskell setup preamble into a composite action

Four jobs across three workflows open with the same preamble — checkout, `haskell-actions/setup`, and in most cases `cabal update`:

- `.github/workflows/ci.yml` — `build`
- `.github/workflows/ci.yml` — `coverage` (added in #133)
- `.github/workflows/pre-commit.yml` — `pre-commit`
- `.github/workflows/publish.yml` — `publish`

Four call sites is past the rule-of-three bar for extracting a `.github/actions/setup-haskell/action.yml` and calling it from each.

The pins have already drifted, which is the concrete cost of the duplication: `ci.yml` uses `actions/checkout@3d3c42e5` (v7.0.1) and `haskell-actions/setup@6037f336` (v2.12.0), while `pre-commit.yml` and `publish.yml` still sit on `actions/checkout@9c091bb2` (v7) and `haskell-actions/setup@cd0d9bdd` (v2). Extracting unifies them in one place and gives Renovate a single target.

Worth noting the jobs aren't identical — `build` parameterises the GHC version from a matrix, `coverage` pins 9.14, `pre-commit` pins 9.4.7 (the newest GHC the pinned `hlint-3.6.1` resolves against), and `publish` takes the default. So the action needs a `ghc-version` input with a sensible default, and `cabal update` probably wants to be opt-in since `publish` doesn't run it.

Split out of #133, where the coverage job added the fourth call site. Deliberately not done there to keep a coverage change from touching the publish and pre-commit workflows.