[DELENG-365] Add catalog workflow to use whitelisted SHA

[KostenetskyiAndrii]

Note: This PR creates a new catalog.yml workflow file.

Summary

Updates the catalog workflow to use the whitelisted SHA from service-catalog with proper documentation.

Changes

• Updates docs job to use service-catalog/.github/workflows/docs-like-code.yaml@436c9e4b5ba68282956ffa169ae714827cf49bc5
• Updates catalog-upload job to use service-catalog/.github/workflows/catalog-upload.yaml@436c9e4b5ba68282956ffa169ae714827cf49bc5
• Adds documentation comments explaining:
  • SHA source (service-catalog PR add information to unexpected 404 for forensics; fix inject error issues #113 merge commit)
  • WIF pool whitelist location
  • Production classification requirements

Context

As part of the WIF pool migration (service-catalog PR #113), all repos using catalog workflows need to reference the whitelisted SHA. This SHA is specifically allowed in the pantheon-service-catalog WIF pool configuration for production access.

Testing

• Workflow will use the new WIF pool: pantheon-service-catalog in project pantheon-wif
• Authentication will work with both main and master branches
• Secrets and GCS bucket access will use production credentials

Related

• Ticket: DELENG-365
• Service Catalog PR: https://github.com/pantheon-systems/service-catalog/pull/113
• WIF Configuration: https://github.com/pantheon-systems/gce-terraform/blob/master/projects/pantheon-wif/workload-identity-federation.tf

[wiz-inc-b08cf2810f]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	-
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[djschaap]

Be aware this is a PUBLIC repo that is essentially in maintenance mode. Merging changes such as this may not be advisable.