ci: split tests into separate workflow to avoid running on irrelevant changes

Moved the `prepare_test_image_testdata`, `tests`, and `docker` jobs from
`checks.yml` into a new `tests.yml` workflow file.

Configured `paths-ignore` for the `tests.yml` workflow so that these long-running
tests are skipped if changes only affect markdown files, documentation, scripts,
or other unrelated GitHub Actions workflows. This prevents unnecessary test runs
while still executing quick lint and formatting checks in `checks.yml`.

Additionally, fixed zizmor alerts for cache poisoning and credential persistence
in the docker job, and formatted the new file with prettier.

Co-authored-by: another-rex <106129829+another-rex@users.noreply.github.com>

Author: google-labs-jules[bot]

.github/workflows/tests.yml

@@ -18,22 +18,22 @@ on:
   push:
     branches: ["main", "v1", "mcp"]
     paths-ignore:
-      - '**/*.md'
-      - 'docs/**'
-      - '.github/workflows/*'
-      - '!.github/workflows/tests.yml'
-      - '!.github/workflows/test-action/**'
-      - 'scripts/**'
+      - "**/*.md"
+      - "docs/**"
+      - ".github/workflows/*"
+      - "!.github/workflows/tests.yml"
+      - "!.github/workflows/test-action/**"
+      - "scripts/**"
   pull_request:
     # The branches below must be a subset of the branches above
     branches: ["main", "v1", "mcp"]
     paths-ignore:
-      - '**/*.md'
-      - 'docs/**'
-      - '.github/workflows/*'
-      - '!.github/workflows/tests.yml'
-      - '!.github/workflows/test-action/**'
-      - 'scripts/**'
+      - "**/*.md"
+      - "docs/**"
+      - ".github/workflows/*"
+      - "!.github/workflows/tests.yml"
+      - "!.github/workflows/test-action/**"
+      - "scripts/**"
   workflow_dispatch:
 
 concurrency:
@@ -102,11 +102,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
           check-latest: true
+          cache: false
       - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
       - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - name: Run GoReleaser