[backport-security_detection_engine-9.4] Sync CI configuration with main branch - #20416

Syncs CI and backport-automation configuration from main onto the backport-security_detection_engine-9.4 branch, including migrating automation logic into a standalone cmd/backport sub-module so backport branches can run the same workflows and tooling as main.

Changes:

• Adds/updates GitHub Actions workflows and a composite action to support backport changelog syncing (including retry via /sync-changelog) and automated backport PR creation.
• Introduces a self-contained cmd/backport Go sub-module and updates Buildkite/GitHub workflows/scripts to use the backport binary instead of mage targets.
• Updates Buildkite pipelines/scripts to optimize package selection and to add new checks around changelog and backport tooling.

Suppressed comments (2)

.buildkite/scripts/backport_branch.sh:170

• Same issue here: sed regular expressions don’t treat \s as whitespace, so the K8S_VERSION line replacement won’t match and the preserved pin won’t be restored.

    echo "--- Restoring K8S_VERSION in ${pipeline_yml}..."
    sed -i "s|^\s*K8S_VERSION:.*|${k8s_version_line}|" "${pipeline_yml}"
  fi

.buildkite/scripts/backport_branch.sh:174

• Same sed regex issue for KIND_VERSION: \s won’t match whitespace, so this restore step will be a no-op.

  if [ -n "${kind_version_line}" ]; then
    echo "--- Restoring KIND_VERSION in ${pipeline_yml}..."
    sed -i "s|^\s*KIND_VERSION:.*|${kind_version_line}|" "${pipeline_yml}"
  fi

• Files reviewed: 103/114 changed files
• Comments generated: 2
• Review effort level: Lite

• Files reviewed: 106/116 changed files
• Comments generated: 2
• Review effort level: Lite

• Files reviewed: 106/116 changed files
• Comments generated: 1
• Review effort level: Lite

• Files reviewed: 105/115 changed files
• Comments generated: 0 new
• Review effort level: Lite