ci: make unused EE database inputs optional

[XuPeng-SH]

Summary

• Keep the legacy EE_DB_* workflow-call names for compatibility.
• Mark those five inputs optional because ci.yaml no longer consumes them.
• Leave the S3 test secrets required; no job, timeout, retry, or runner behavior changes.

Root cause

MatrixOne's reusable-workflow call was rejected before runner allocation when the caller could not provide EE_DB_ADDR, EE_DB_PORT, EE_DB_USER, EE_DB_PASSWORD, and EE_DB_DB. These declarations were added for the historical failed-UT-to-MOC action, which is no longer present in this workflow. The current ci.yaml has no secrets.EE_DB_* consumer.

This is the shared-workflow side of matrixorigin/matrixone#27822. It also unblocks the ordered restoration of the four-shard race-UT caller described by the recurrence tracked in matrixorigin/matrixone#28538.

Compatibility and security

This is a monotonic contract relaxation: callers that pass these secrets behave exactly as before, while callers that do not pass unused credentials are no longer rejected at workflow evaluation. The names remain declared for explicit callers. No credential is added to a job environment or forwarded to a new consumer.

If an EE database is needed again, the workflow that actually consumes it must declare and validate that dependency locally.

Test plan

• git diff --check
• Ruby YAML parse of .github/workflows/ci.yaml
• Contract assertion that all five EE_DB_* declarations are required: false
• Static assertion that ci.yaml contains no secrets.EE_DB_* consumer
• GitHub's existing actionlint and workflow-schema checks will run on this workflow-only change