TRU-327: Migrate CI/CD from Azure Pipelines to GitHub Actions

[jtcrde]

Summary

Migrates this repo's CI/CD off Azure Pipelines (which relies on the shared pipeline-library and runs in quantumci.azurecr.io/quantum-ci-terragrunt containers) onto a self-contained GitHub Actions workflow at .github/workflows/ci.yaml. Follows the patterns established in migration-plan.md and infrastructure-live-staging/.github/workflows/run-regression.yaml.

Changes

• Add .github/workflows/ci.yaml
• Remove azure-pipelines.yml

Behavior parity with the old pipeline

Step	ADO (old)	GHA (new)
SSH key	AzureKeyVault@1 + import-ssh-key.yml	secrets.QUANTUM_CI_BOT_GITHUB_SSH_KEY
Submodules	init-git-submodules.yml	actions/checkout submodules: recursive
Pre-commit	pre-commit run --all-files	same, plus explicit terraform/tflint/tfsec setup
NPM	npm ci + global links	setup-node + npm install -g semantic-release toolchain
Checkov	run-ci-analysis.yml (--quiet --soft-fail)	direct checkov call (--quiet --soft-fail, continue-on-error)
Semantic release	semantic-release.yml	npx semantic-release on master/main
Update infra-modules	update-source-reference.yml	inline bash: clone, sed ?ref=, GPG-signed commit, direct push for minor/patch, PR for major
Terratest	conditional (this repo runs with runFunctionalTests: false)	omitted

Why

• Solves the 10-min timeoutInMinutes hard-cap from terraform.yml template (now timeout-minutes: 30).
• Aligns with TRU-329's direction (moving repos to a new org that doesn't use Azure DevOps).
• Will serve as the template for the other package-* terraform repos when their migration turn comes.

Required secrets (must be present on the repo or org)

• QUANTUM_CI_BOT_GITHUB_SSH_KEY
• QUANTUM_CI_BOT_GITHUB_TOKEN
• QUANTUM_CI_BOT_NPM_TOKEN
• IMPORT_GPG_KEY, IMPORT_GPG_KEY_ID, IMPORT_GPG_KEY_PASSPHRASE, IMPORT_GPG_KEY_SUBJECT

Test plan

• Push commit to this branch — workflow triggers, checkout / SSH key / pre-commit / checkov all succeed
• Verify semantic-release and Update infrastructure-modules references steps are skipped on non-master
• Merge to master — verify a release is cut and infrastructure-modules gets the auto-bump commit
• After merge, retrigger CI on XDR-7734: Bump terraform-version to 1.3.10 #32 (terraform-version bump) to confirm it now passes on GHA