Add ImportSecretsAs to import GitHub Actions secrets under an explicit env name

[ChrisonSimtian]

Problem

ImportSecrets derives the secret name from the parameter name. It cannot import a secret like OPS_API_TESTS_NZPOST_KEY (derivation gives NZ_POST). It also cannot set env names such as Apis__NzPost__FunctionKey. Consumers work around this by overriding the protected GetImports() in a subclass.

Outcome

• New GitHubActionsAttribute.ImportSecretsAs property. Entries are ENV_NAME: SECRET_NAME.
• Emitted on the run step's env: as ENV_NAME: ${{ secrets.SECRET_NAME }}, after ImportSecrets.
• Secrets stay on the run step only.
• Empty property: generated output is unchanged.
• Validation, in the same style as Env:
  • env name and secret name must be non-empty
  • no whitespace in either
  • no duplicate env names across ImportSecrets and ImportSecretsAs

Notes

• Additive, non-breaking. Targets develop.
• Backport to the 10.4.x line after merge, if it should ship as a patch.
• Docs: new section in docs/website/05-cicd/github-actions.md.

Tests

• Two snapshot specs: ImportSecrets alone, and both properties together.
• GitHubActionsImportSecretsAsSpecs: malformed entries, duplicates, same secret under two env names.
• GitHubActions and ConfigurationGeneration specs pass.