CI: Introduce basic OpenVMM testing and utilize reusable actions

[Maheer Aeron (maheeraeron)]

Adds basic Ubuntu boot testing with OpenVMM from the latest successful main run, and also organizes certain steps into github actions. Furthermore, external github actions are now pinned to a commit SHA.

The OpenVMM tests are limited to X64 for now. ARM64 support will come in the future.

[Mike Ebersol (mebersol)]

[Copilot] Overall this is a good direction — SHA-pinning the third-party actions, fail-fast: false, if-no-files-found: error, and the log-upload step are all real improvements, and adding -legacy-${{ matrix.c-core }} to the artifact name fixes a latent duplicate-artifact-name collision in the old workflow.

Leaving four comments: one blocking (the fork/secrets issue on openvmm-test-x64, which also gates release), and three smaller ones around consistency and discoverability.

[Mike Ebersol (mebersol)]

[Copilot] Re-reviewed at b5b0019. All four comments from my first pass are properly addressed — dropping the PAT in favour of ${{ github.token }} is a better answer than the fork guard I suggested, and replacing the magic -ne 6 with -eq 0 is the right call given needs: build already requires every matrix leg to pass. The run-selection loop that skips OpenVMM runs with expired or missing artifacts, normalize_bundle_file, and adding dependabot.yml alongside the SHA pinning are all good additions.

Three comments on the new iteration. The OFFICIAL_BUILD one is the only one I'd want resolved before merge — silent loss of the official-build flag on main is the kind of thing that stays invisible for months.