[oblt-aw][security] Scope workflow secrets for SEC-022 remediation

Closes #1063

## Summary
This changeset remediates SEC-022 secret-scoping exposure by replacing `secrets: inherit` with explicit `COPILOT_GITHUB_TOKEN` mapping in reusable workflow calls and ingress call sites.

## Plan checklist
- [x] Read and apply SEC-022 remediation pattern (least-privilege secret scoping)
- [x] Replace inherited secret propagation with explicit secret mappings
- [x] Add explicit `workflow_call` secret contracts where required
- [x] Run validation commands and confirm expected behavior

## Implemented changes
- Replaced `secrets: inherit` with:
- `secrets: COPILOT_GITHUB_TOKEN: $\{\{ secrets.COPILOT_GITHUB_TOKEN }}` in:
- `.github/workflows/gh-aw-agent-suggestions.yml`
- `.github/workflows/gh-aw-resource-not-accessible-by-integration-detector.yml`
- `.github/workflows/gh-aw-security-fixer.yml`
- `.github/workflows/gh-aw-autodoc.yml` (`audit`, `fix` jobs)
- `.github/workflows/oblt-aw-ingress.yml` (`autodoc`, `issue-fixer`, `resource-not-accessible-by-integration-fixer`, `security-fixer` jobs)
- Added explicit reusable-workflow secret declarations:
- `.github/workflows/gh-aw-issue-fixer.yml`
- `.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.yml`

## Validation evidence
- `npm test` passed (`15 passed, 0 failed`)
- `./scripts/obs/security-scan.sh . | grep 'SEC-022' || true` returned no SEC-022 lines

## Security requirements confirmation
- **Least-privilege:** applied by removing broad `secrets: inherit` propagation and scoping calls to only `COPILOT_GITHUB_TOKEN`.
- **Env-indirection:** preserved; no direct secret interpolation was added to shell command strings.

## Notes
- `.github/workflows/oblt-aw.yml` was not modified per repository guardrails.

> [!NOTE]
>
> 🔒 Integrity filter blocked 15 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#1063](https://github.com/elastic/oblt-aw/issues/1063) `issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1063](https://github.com/elastic/oblt-aw/issues/1063) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1062](https://github.com/elastic/oblt-aw/issues/1062) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1064](https://github.com/elastic/oblt-aw/issues/1064) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1065](https://github.com/elastic/oblt-aw/issues/1065) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1067](https://github.com/elastic/oblt-aw/issues/1067) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1052](https://github.com/elastic/oblt-aw/issues/1052) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1035](https://github.com/elastic/oblt-aw/issues/1035) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1020](https://github.com/elastic/oblt-aw/issues/1020) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1011](https://github.com/elastic/oblt-aw/issues/1011) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#998](https://github.com/elastic/oblt-aw/issues/998) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#989](https://github.com/elastic/oblt-aw/issues/989) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#975](https://github.com/elastic/oblt-aw/issues/975) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#963](https://github.com/elastic/oblt-aw/issues/963) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#948](https://github.com/elastic/oblt-aw/issues/948) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Observability Agentic Workflow Entrypoint](https://github.com/elastic/oblt-aw/actions/runs/26498518025)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/elastic/oblt-aw/actions/runs/26498518025)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 26498518025 -n agent -D /tmp/agent-26498518025

# Fetch the bundle into a local branch
git fetch /tmp/agent-26498518025/aw-elastic-oblt-aw-fix-sec-022-secret-scoping-1063.bundle refs/heads/fix/sec-022-secret-scoping-1063:refs/heads/fix/sec-022-secret-scoping-1063-0b660be0a4c72276
git checkout fix/sec-022-secret-scoping-1063-0b660be0a4c72276

# Push the branch to origin
git push origin fix/sec-022-secret-scoping-1063-0b660be0a4c72276

# Create the pull request
gh pr create --title '[oblt-aw][security] Scope workflow secrets for SEC-022 remediation' --base main --head fix/sec-022-secret-scoping-1063-0b660be0a4c72276 --repo elastic/oblt-aw
```