ci: isolate object storage integration tests

[gouhongshen]

Summary

• remove cloud object-storage credentials from the required short UT coverage workflow
• add a reusable Aliyun/QCloud integration workflow that checks out an immutable MatrixOne revision
• run each provider in its own non-short job with MO_RUN_EXTERNAL_OBJECT_STORAGE_TESTS=1 and only that provider's test specification

Why

UT coverage currently exports ambient provider credentials into go test -short. That lets a cross-cloud TCP failure fail unrelated PR coverage. The replacement keeps required coverage hermetic and moves real provider contracts to an explicit, provider-isolated tier.

Security and Scope

The reusable workflow receives only the two provider specifications. Its MatrixOne caller is responsible for the pull_request_target trust gate before exact PR code executes with a provider credential. No production MatrixOne code changes are included.

Rollout

This PR must merge before the paired MatrixOne caller PR. After the caller lands, the existing MatrixOne fileservice isolation PR can rerun its exact head through this workflow before merging.

Related: matrixorigin/matrixone#26541, matrixorigin/matrixone#28291

Validation

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/coverage-ut.yaml .github/workflows/object-storage-integration.yaml
• YAML parse for both workflows
• git diff --check