Add a typed step-injection pipeline to the GitHub Actions generator

[avidenic]

Closes #456.

Problem

GitHubActionsAttribute.GetSteps() yields a fixed, closed step sequence with no hook points and is private. No way to inject a marketplace action or custom shell step at a chosen position.

Outcome

A build implements IConfigureGitHubActions.ConfigureSteps(GitHubActionsStepPipeline) to inject typed uses:/run: steps at four named positions — compile-checked, no reflection.

partial class Build : NukeBuild, IConfigureGitHubActions
{
    public void ConfigureSteps(GitHubActionsStepPipeline pipeline)
    {
        if (pipeline.WorkflowName != "security") return;   // scope by workflow / runner
        pipeline.Insert(GitHubActionsStepPosition.PostRun, new GitHubActionsCustomStep
        {
            Name = "Perform CodeQL Analysis",
            Uses = "github/codeql-action/analyze@v3",
            If = "github.ref == 'refs/heads/main'",
        });
    }
}

New public types: GitHubActionsCustomStep, GitHubActionsStepPosition (PostCheckout/PreRun/PostRun/JobEnd), IConfigureGitHubActions, GitHubActionsStepPipeline.

Notes

• Positions anchor to the always-present checkout + run block, so they resolve whether or not cache/artifacts are present.
• Validation fails the build (never emits invalid YAML): exactly one of Uses/Run; With requires Uses; Shell only on a run step.
• Additive / non-breaking. Generator stays in sole control of the base sequence; the hook only inserts.
• The hook is invoked per job with identity on the pipeline context (not the interface signature) and a read-only BuiltInSteps view — deliberately composes with the [GitHubActions] generator: emit CD pipelines (or a thin shell delegating to dotnet fallout Deploy) #336 job-DAG work rather than being reworked by it. Job-level concerns (needs:/outputs:/env gates) are out of scope for [GitHubActions] generator: emit CD pipelines (or a thin shell delegating to dotnet fallout Deploy) #336.
• New API follows the subsystem's existing idioms; matched to [GitHubActionsInput]'s validation style.

Acceptance criteria

• Inject uses:/run: at each of the four positions; multiple inserts at one position render in call order.
• Positions resolve correctly with cache/artifacts absent.
• Invalid steps fail generation with a clear ArgumentException.
• Steps scope to a workflow/runner via WorkflowName/Image (no per-step scoping arrays).
• No churn on existing snapshots.

Verification

Full Fallout.Common.Specs suite: 114 passed, 7 skipped, 0 failed. Zero snapshot churn. Full-solution build clean.

[IT-VBFK]

Suggested change

	yaml.Should().Be(
	"- name: Setup Node\n" +
	" uses: actions/setup-node@v4\n" +
	" with:\n" +
	" node-version: 20\n");
	yaml.Should().Be(
	"""
	- name: Setup Node
	uses: actions/setup-node@v4
	with:
	node-version: 20
	""");

I vote for string literal in general, like so