ci: split tests into separate workflow to avoid running on irrelevant changes

Moved the `prepare_test_image_testdata`, `tests`, and `docker` jobs from
`checks.yml` into a new `tests.yml` workflow file.

Configured `paths-ignore` for the `tests.yml` workflow so that these long-running
tests are skipped if changes only affect markdown files, documentation,
or other unrelated GitHub Actions workflows. This prevents unnecessary test runs
while still executing quick lint and formatting checks in `checks.yml`.

Additionally, fixed zizmor alerts for cache poisoning and credential persistence
in the docker job, and formatted the new file with prettier. Fixed out-of-date
test snapshots and updated VCR cassettes that were causing CI failures.

Co-authored-by: another-rex <106129829+another-rex@users.noreply.github.com>

Author: google-labs-jules[bot]