[Feature request] Support explicit secret scoping on custom jobs

## Problem

Custom jobs all receive secrets: inherit in the generated release.yml. This passes every repository secret to every reusable workflow, regardless of whether the workflow needs them.

Ex.
I'm adding a winget publishing post-announce job. The reusable workflow declares a single secret:

```yaml
on:
workflow_call:
inputs:
plan:
required: true
type: string
secrets:
WINGET_TOKEN:
required: true
```

But the generated caller in release.yml passes all secrets:
```yaml
custom-publish-winget:
needs: [plan, announce]
uses: ./.github/workflows/publish-winget.yml
with:
plan: ${{ needs.plan.outputs.val }}
secrets: inherit # passes every repo secret, not just WINGET_TOKEN
```

I'd like to be able to configure the generated YAML to be:
```yaml
custom-publish-winget:
needs: [plan, announce]
uses: ./.github/workflows/publish-winget.yml
with:
plan: ${{ needs.plan.outputs.val }}
secrets:
WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
```

## Proposal

This follows the pattern of `github-custom-job-permissions` (#1179).

I'm proposing a new key in `dist-workspace.toml`, e.g., `github-custom-job-secrets`, as follows:

```toml
github-custom-job-secrets = { "publish-winget" = ["WINGET_TOKEN"], "my-other-workflow" = ["SOME_SECRET", "SOME_OTHER_SECRET"] }
```

Happy to submit a PR for this if it would be considered :)

Start with the github-custom-job-permissions implementation referenced in the proposal and the dist-workspace.toml configuration that drives generated release.yml. Trace how custom jobs and their secrets are emitted, then verify the new configuration produces explicit secret mappings such as WINGET_TOKEN instead of secrets: inherit.

Written by the indexing model from the issue text.