secret-scan: PR-scoped Slack alerts with samples, per-repo internal-refs opt-out

[Abdelsalam-Abbas]

Manual sync of the upstream secret-scan changes (Astera-org/github-workflows#5). See that PR for full rationale.

• Slack alerts on PRs now fire only for findings introduced by the PR's own commits; historical findings stay in the step summary and the informational check run instead of re-posting on every push.
• Slack message includes the PR link, new-vs-total counts, and up to 5 sample rows (rule, file, line).
• New per-repo opt-out for the internal-refs job: set the repo Actions variable SECRET_SCAN_SKIP_INTERNAL_REFS=true (intended for dynamic-pdb and similar repos that legitimately reference internal infra).