[backport-tenable_io-3.10] Sync CI configuration with main branch - #21173

This PR synchronizes CI, GitHub Actions, tooling, and backport automation from main to the backport branch.

Changes:

• Adds the standalone backport CLI and related changelog, checklist, ownership, and package-detection logic.
• Updates Buildkite/GitHub workflows and dependencies.
• Removes legacy test-reporting and backport implementations.

Suppressed comments (11)

.buildkite/scripts/backport_branch.sh:238

• The backport sync copies requires-update.yml into the branch, but this deletion removes the RequiresUpdate Mage target that the workflow dispatches with mage RequiresUpdate. A manual run of that workflow on any synced backport branch will fail with an unknown target; keep the target and its dependencies, or exclude/disable this workflow for backport branches.
  .github/workflows/post-backport-checklist.yml:7
• This copied workflow only runs after Backport — detect packages, while that workflow is restricted to pull requests targeting main. It therefore never fires for an auto-backport PR targeting backport-*, so syncing this file does not provide the branch-targeted post-backport automation described in the PR and related issue. Add the pull-request workflow for backport targets (or clarify that this is source-PR-only automation).
  .github/workflows/requires-update.yml:68
• Generated backport branches remove magefile_daily_jobs.go (the file that defines RequiresUpdate) while this workflow is copied onto the branch. A manual dispatch against such a branch therefore fails at mage RequiresUpdate because the target is unavailable; either keep the target/dependencies or omit this main-only workflow when assembling backport branches.
  .github/workflows/sync-backport-changelog.yml:108
• For a rebase-merged PR, mergeCommit.oid is the last rebased commit and parents[0] is only the preceding PR commit. This makes the retry range cover just the final commit, so changelog entries introduced by earlier commits are silently omitted. Resolve the full merged PR range (or all PR commits) instead of using the last commit's parent.
  .github/workflows/validate-yaml-dashboards.yml:172
• For a nested package such as packages/technology/foo/_dev/shared/kibana, this extracts technology as the package name and compiles into packages/technology/kibana/dashboard instead of the nested package's dashboard directory. Derive the package directory from the path before /_dev/ so nested packages validate their own committed JSON.
  .github/workflows/validate-yaml-dashboards.yml:125
• This step repeats the direct interpolation of the PR-controlled changed-file list into shell source. A crafted dashboard filename can execute shell substitutions before the loop runs; pass the list through env: and consume it with newline-safe iteration.
  .github/workflows/validate-yaml-dashboards.yml:161
• unique_dirs is derived from PR-controlled paths and is interpolated into shell source here. A crafted directory name can execute shell substitutions, while space splitting corrupts valid paths; pass it through env: and iterate safely instead.
  cmd/backport/backports/apply/apply.go:840
• The apply --json contract writes only JSON to stdout, but this owner-sync commit uses Git.Run, which forwards git's commit summary to stdout before runApply marshals the result. Consumers piping this output to jq will receive invalid JSON. Use the existing RunToStderr helper for this command.
  cmd/backport/backports/apply/apply.go:853
• This comment also claims go.mod pins Go 1.22, while cmd/backport/go.mod declares Go 1.26.0. Please correct the version reference so the compatibility guidance matches the module being built.
  cmd/backport/backports/checklist/checklist.go:105
• This comment says the backport module pins Go 1.22, but cmd/backport/go.mod in this change declares Go 1.26.0. The stale version claim can mislead maintainers about the toolchain compatibility rationale; update or remove it.
  cmd/backport/main.go:249
• The package-detect workflow passes the PR base tip and head SHA here, so before..after compares the two trees and includes changes that landed on the base branch after the PR was opened. That can add unrelated packages to the checklist/owner check. Use the three-dot PR range (as the changelog code already does) so only changes from the merge base to the head are detected.

• Files reviewed: 174/196 changed files
• Comments generated: 10
• Review effort level: Lite