Detect which repositories consume reusable workflows

🙋 User Need
As a DevX platform engineer
I want to detect which repositories consume reusable workflows
so that I can see how widely shared workflow patterns are adopted across the MoJ GitHub estate and identify repositories maintaining bespoke workflows that could be consolidated.

💡 Value / Purpose
• Reusable workflows reduce duplication and allow security improvements to propagate centrally rather than repo-by-repo.
• The estate currently has no visibility into which repos consume reusable workflows versus maintaining their own.
• Identifying low adoption highlights consolidation opportunities and repos that miss centrally delivered security fixes.
• Feeds the discovery dashboard’s estate-wide posture view.

🛠️ Description / Context
A reusable workflow is referenced via a job-level uses: pointing to a .github/workflows/*.yml file in another repository, using the owner/repo/.github/workflows/file.yml@ref syntax. This is distinct from an action referenced via a step-level uses:. This stage parses every workflow file already collected by the discovery tool and classifies each repository by whether it consumes reusable workflows, which ones, and from where.
Steps:

1. Extend the workflow parser to detect job-level uses: references pointing to reusable workflows, distinguishing them from step-level action uses:.
2. For each reference, capture the source repository, the workflow file path, and the pinned ref (branch, tag, or commit SHA).
3. Classify each repository as: consumes reusable workflows / does not / could not load.
4. Aggregate per-repo and estate-wide counts.
5. Write results to the discovery output CSVs and the estate summary JSON.

✅ Definition of Done
• Reusable workflow consumption detected per workflow file.
• Per-repo classification produced.
• Estate-wide adoption count available in the estate summary JSON.
• Output written to the discovery CSVs.
• Results validated against a sample of known repositories.

🔧 Testing steps
• Verify a repo known to consume a reusable workflow is correctly flagged.
• Verify a repo using only step-level actions is not misclassified as consuming reusable workflows.
• Confirm could_not_load workflows are handled and not silently dropped.
• Spot-check the estate summary count against a manual sample.

❓ Additional Information
• Source data: the workflow files already collected by the discovery tool.
• The job-level uses: versus step-level uses: distinction is the key parsing concern.
• Output feeds github_workflow_posture_repo_summary.csv and github_workflow_posture_estate_summary.json.