ci: add ASF allowlist check

[delei]

Purpose of the pull request

ASF GitHub Actions policy failures can surface as startup failures with little useful job output. Adding the ASF allowlist check makes workflow allowlist violations visible during PR review before they reach main.

What's changed?

1. add ASF allowlist check

This adds a dedicated ASF Allowlist Check workflow for .github/** changes. It runs apache/infrastructure-actions/allowlist-check@main against .github/**/*.y*ml, covering both workflow files and composite action YAML files.

References:

• ASF Allowlist Check

2. bump markdownlint-cli2 from 0.20.0 to 0.23.1

Fix the issues identified in the CI and modify the allowed version.

> website@1.0.0 md-lint /Users/deleiguo/WorkSpace/gitrepo/deleiguo/fesod/website
> markdownlint-cli2 --config ./.markdownlint-cli2.jsonc "./**/*.md" "#node_modules"

markdownlint-cli2 v0.23.1 (markdownlint v0.41.1)
Finding: ./**/*.md !node_modules website/**/*.md !**/node_modules/** !**/target/** !**/dist/**
Linting: 123 files
Summary: 0 issues in 0 files

Checklist

• I have read the Contributor Guide.
• I have written the necessary doc or comment.
• I have added the necessary unit tests and all cases have passed.

[Copilot]

Pull request overview

This PR adds a dedicated GitHub Actions workflow to surface Apache Software Foundation (ASF) allowlist violations for .github/** changes during PR review, and updates the website’s markdown lint tooling to a newer markdownlint-cli2 release.

Changes:

• Add a new ASF Allowlist Check workflow to validate .github/**/*.y*ml against ASF allowlist policy.
• Upgrade markdownlint-cli2 (and related transitive deps) in the website workspace.
• Adjust docs CI to accommodate the markdown lint update and apply a minor markdown formatting tweak.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
website/pnpm-lock.yaml	Updates the lockfile for the markdownlint-cli2 bump and associated dependency graph changes.
website/package.json	Bumps markdownlint-cli2 dependency version to ^0.23.1.
website/docs/sheet/read/simple.md	Minor formatting change (adds a blank line).
.github/workflows/ci-docs.yml	Updates docs CI install and markdownlint action reference.
.github/workflows/asf_allowlist_check.yml	Introduces the ASF allowlist validation workflow for .github/** changes.

Files not reviewed (1)

• website/pnpm-lock.yaml: Generated file

[alaahong]

LGTM