Add workflow_dispatch and repository_dispatch to github notification service

# Summary
Add native support to the GitHub notification service for triggering GitHub Actions workflows via the `workflow_dispatch` and/or `repository_dispatch` REST API endpoints, alongside the existing `status`, `deployment`, `pullRequestComment`, and `checkRun` operations.

# Motivation
My primary use case is running post-deployment actions in GitHub Actions. E.g., kicking off automated tests against an environment as soon as Argo CD reports the Application is `Healthy + Synced`.

I do this today using the generic webhook notification service pointed at GitHub's `workflow_dispatch` endpoint (`POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches`). It works, but it would be better if this were implemented as a first-class GitHub operation:

- **Auth duplication.** The GitHub notification service already supports GitHub App authentication (`appID`, `installationID`, `privateKey`). The webhook workaround forces me to provision and rotate a *separate* PAT or app token just to call `workflow_dispatch`, and store it in a different secret.
- **No reuse of GitHub-aware config.** The webhook approach requires hardcoding the repo URL/owner in the webhook config, whereas the GitHub service already derives the repo from the Application source.
- **Discoverability.** "Run my GitHub Actions tests after an Argo CD sync" is a common need, but new users don't realize they have to build a webhook template against the GitHub REST API by hand. A first-class operation alongside `status` / `deployment` / `checkRun` would make this an obvious one-liner.

# Proposal

Add a `workflowDispatch` operation to the GitHub notification service, reusing the existing GitHub App auth so no new credential surface is needed.

```yaml
template.app-deployed: |
github:
repoURLPath: "{{.app.spec.source.repoURL}}"
revisionPath: "{{.app.status.operationState.syncResult.revision}}"
workflowDispatch:
workflow: post-deploy-tests.yml
ref: main
inputs:
application: "{{.app.metadata.name}}"
revision: "{{.app.status.operationState.syncResult.revision}}"
environment: "{{.app.metadata.labels.environment}}"
```

A `repositoryDispatch` variant (sending an `event_type` + `client_payload` to `POST /repos/{owner}/{repo}/dispatches`) would be a useful follow-up for fan-out cases, but `workflowDispatch` is the priority since it's what my current webhook workaround calls.

Start by locating the GitHub notification service and its existing status, deployment, pullRequestComment, and checkRun operations, then compare their GitHub App authentication and request construction. Add the proposed workflowDispatch configuration for workflow, ref, and inputs, targeting the documented workflow_dispatch endpoint; done means it can trigger a workflow without separate credentials.

Written by the indexing model from the issue text.