Surge workflow - secret availability is not tested

The surge workflow requires a secret, however we don't actually test that the secret is available. As a result, when a repo which uses the workflow successfully (like `community.hashi_vault`) is forked, the [workflow in the fork fails](https://github.com/briantist/community.hashi_vault/actions/runs/1671361849) unless the fork's owner sets a working secret.

I think the shared workflow should check for the existence of the secret first of all (GitHub does not provide a nice way to do this but I think we can compare to empty string), and it should provide an option that controls what to do when the secret is missing (skip tasks and be "successful" or fail), so that the caller can decide how to handle it.

Start by inspecting the shared surge workflow and how callers configure it, then reproduce the fork scenario with the secret unavailable. Done means the workflow detects a missing secret and callers can choose whether to skip the tasks successfully or fail; verify both behaviors against the linked fork failure.

Written by the indexing model from the issue text.