feat: Add additional-paths config to specify dependencies outside of package

[Leundai]

This adds support for the 'additional-paths' configuration option that allows a package to declare dependencies on file paths outside its main package directory. When commits modify files in these additional paths, they will be included in the release for the dependent package.

This is useful for monorepos where multiple packages may depend on shared code that lives outside their package directories.

Inspired by googleapis#2534

---

Summary of Changes

Core Implementation

• schemas/config.json: Added additional-paths schema definition (array of strings, manifest-only)
• src/manifest.ts: Added additionalPaths to ReleaserConfig interface and updated CommitSplit instantiation to pass Record<string, string[]> format
• src/util/commit-split.ts: Changed packagePaths type from string[] to Record<string, string[]> and implemented two-pass commit assignment:
  1. First pass: assign commits to primary package based on main path
  2. Second pass: assign commits to additional packages based on their additional-paths
• src/util/commit-utils.ts: Extracted normalizePath function for single path normalization

Tests

• Added test fixture test/fixtures/manifest/config/additional-paths.json
• Added test for reading additional-paths from manifest config
• Added test for commits in additionalPaths triggering releases
• Added test for commits belonging to multiple components via additional-paths
• Updated existing CommitSplit tests to use new Record<string, string[]> format

CI Fix

• Updated .github/workflows/ci.yaml to reference nominal-io/release-please instead of googleapis/release-please for the build-action job

Human Review Checklist

• Verify the two-pass commit assignment logic in commit-split.ts:98-140 correctly assigns commits to both primary and additional packages
• Check that the dedupe Set properly prevents duplicate commit assignments while still allowing commits to be shared across packages via additional-paths
• Confirm the Record<string, string[]> format change doesn't break any other usages

---

Link to Devin run: https://app.devin.ai/sessions/60f42b0519ac4cd2bdd8ab1de108eddf
Requested by: Leo Galindo-Frias (@Leundai)

---

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> 🦕

[helenyugithub]

is this making it required?

[Leundai]

This is more of a whitelist to control what properties can be used at the json "root" level.

Its used in conjunction with:
https://json-schema.org/understanding-json-schema/reference/object#additionalproperties

[Leundai]

I.e if this was false, we would only be able to use additional-paths in the "packages" directory. Its sometimes useful if a repo wants to apply a trigger on ALL packages. (fern docs is an example of this)

scout not so much