Improve required checks creation in CI

[jgiannuzzi]

This PR improves how we create the required check "All required checks succeeded" in the following ways:

• We now use a GitHub app to create the check instead of using the token provided by GitHub Actions.
  This allows us to create the check run with its own check suite instead of attaching it to the first GHA check suite, which changes when a pull request is closed and reopened, or when a new run attempt is made. See https://github.com/orgs/community/discussions/24616#discussioncomment-6088422 for more details on this very annoying GitHub limitation.
• A check is created and set as queued or in_progress when the corresponding workflow run's status changes.
  This is needed so that the check is reset when a new run attempt is made or a PR is reopened.
• Logging is improved.
• Start/Completion times are added.

---

The following tasks need to be completed before merging this PR:

• create and install a new GitHub app with the check:write permissions
• add its credentials to a new create-check environment that can only be accessed by the main branch

---

The following tasks need to be completed after merging this PR:

• update branch protection (or ruleset, if Change CI release logic #452 has been merged in the meantime) to enforce the required check to originate from the new GitHub app

[suprjinx]

I wish Github CI did not require so much custom code -- seems like never ending maintenance if Armada Project is any guide.

[jgiannuzzi]

I wish Github CI did not require so much custom code -- seems like never ending maintenance if Armada Project is any guide.

After 4 years of using GitHub Actions, I wish so too 😞
However, it does keep improving, and we do have a particularly stringent security posture, so 🤷