workflows: fix allowlist update race (#866)

[potiuk]

Summary

Consolidates update_actions.yml (composite → actions.yml) and
update_composite_action.yml (actions.yml → composite) into a single
update_allowlist.yml. The previous pair ran in separate concurrency
groups and could overlap, silently clobbering one direction's edit —
see #866 for raboof's reconstruction of how a dependabot bump got
downgraded.

The combined workflow:

• Triggers on push to main when either file changes
• Single concurrency group so only one run touches the allowlist at a time
• Always runs both directions: merge composite → actions.yml (additive),
  then regenerate composite + approved_patterns.yml from actions.yml
• Checks out latest main HEAD (not the trigger SHA) so a queued run
  sees the prior run's commit
• Rebases and retries on push failure (the sync script is idempotent)

Also updates the README's three mermaid diagrams + prose to point at the
new workflow name. The two utils/check_cache_settings/*.py changes are
prek auto-inserting missing Apache license headers on pre-existing
files — unrelated to #866 but caught by prek run --all-files; CI would
have auto-fixed them anyway.

Fixes #866

Test plan

• uv run pytest gateway/ — 8 passed
• prek run --all-files clean
• After merge: trigger via workflow_dispatch on an unchanged tree
  to confirm no-op behavior
• Watch the next dependabot bump merge to confirm actions.yml +
  composite + approved_patterns.yml all update from a single workflow