ci: opt-in config-server pairing for integration tests (sdc-pair)

[steiler]

Summary

• Integration tests (sdcio/integration-tests reusable workflow) now receive config-server main by default instead of the latest GitHub Release tag.
• Same-named branch on sdcio/config-server is used only when this PR has the label sdc-pair (avoids accidental pairing with unrelated branches that share a name).
• workflow_dispatch: optional input configserver_version pins config-server (checkout + GHCR image tag) when you need an explicit ref (main, full SHA, v0.0.0-PR…, etc.).
• pull-requests: read is required so push runs can detect an open PR on this branch and whether it carries sdc-pair (same behaviour as the pull_request event).

How to use cross-repo (data-server + config-server)

1. Create the sdc-pair label in this repo (Settings → Labels) if it does not exist yet.
2. Use the same branch name on data-server and config-server for the joint change.
3. Ensure config-server CI has published images for the commit you care about (e.g. full SHA tag from nightlies).
4. Add sdc-pair to this PR when you want integration to resolve config-server to that same-named branch tip; otherwise integration stays on config-server main.

Mirror PR (config-server): sdcio/config-server#455

Test plan

• Confirm default branch / PR without sdc-pair uses config-server main in integration.
• Confirm PR with sdc-pair and matching upstream branch resolves to expected SHA / passes integration when images exist.
• Confirm workflow_dispatch with configserver_version set overrides auto resolution.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.