Onboard new backport-pr re-usable github workflow (sql)

[peterzhuamazon]

Description

Onboard new backport-pr re-usable github workflow (sql)

Issues Resolved

opensearch-project/opensearch-build#6270

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 1ae1f80.

Path	Line	Severity	Description
.github/workflows/backport.yml	12	high	Reusable workflow referenced at floating '@main' branch instead of a pinned commit SHA. The previous actions were pinned to specific commit hashes (e.g., tibdex/github-app-token@1901dc7). Using '@main' means any future change to opensearch-project/opensearch-build's backport-pr.yml — including a malicious one — would automatically execute in this repository's CI/CD pipeline. This is a supply chain risk that must be verified by maintainers.
.github/workflows/backport.yml	13	medium	The OPENSEARCH_CI_BOT_TOKEN secret is passed to an externally-controlled reusable workflow pinned only to a floating '@main' reference. If the upstream workflow is compromised or tampered with, the token would be exfiltrated. The risk is compounded by the pull_request_target trigger, which runs with write access to the base repository even for PRs from forks.

The table above displays the top 10 most important findings.

Total: 2 | Critical: 0 | High: 1 | Medium: 1 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.