Validate GitHub workflows against the ASF allowlist

[kpumuk]

When a GitHub Actions workflow references an action that isn't on the ASF org-level allowlist, the CI job silently fails with "Startup failure" — no logs, no notifications, and the PR may appear green because no checks ran. This action catches those problems at PR time with a clear error message.

https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md

Actions not in the allow list

• rubygems/release-gem Add rubygems/release-gem to allowlist infrastructure-actions#789
• pypa/gh-action-pypi-publish@release/v1 - bumped version to the already allowlisted
  • Failed in https://github.com/apache/thrift/actions/runs/25023432978

• Did you create an Apache Jira ticket? (Request account here, not required for trivial changes)
• If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
• Did you squash your changes to a single commit? (not required, but preferred)
• Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
• If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources.