[CI] Cover the legacy distros and the slow macOS runner in a nightly (#7668)

* [CI] Cover the legacy distros and the slow macOS runner in a nightly

Every pull request built ten Linux legs and five macOS/Windows legs, including
the previous release of each distro and macOS 13 on the Intel runner. Those
legs exist to catch a regression for users on an older distribution, which a
change being reviewed almost never does, and macOS 13 Intel is the slowest leg
of the matrix - 28 minutes against 19 for the rest.

They now run in a nightly build of the default branch and on tag builds, which
is when a change actually ships. Pull requests keep the current release of each
distro, the sanitizer leg and the coverage leg.

* [CI] Run the nightly legs from their own jobs

jobs.<id>.if cannot read matrix, so the previous filter never validated and
no leg of this workflow ran. matrix.exclude cannot express it either: GitHub
processes exclude before include, and these matrices are include-only.

Split the regular and nightly legs into two jobs per platform, sharing the
step list through a YAML anchor and gating the jobs on the event instead of
on matrix. The nightly run now covers only the legs a push leaves out, and
the event name is part of the concurrency group so a nightly and a master
push do not cancel each other.

* [CI] Run the coverage leg in the nightly

gcovr.cfg sets no fail_under, so the leg cannot fail a build, and nothing
consumes coverage-report: it was an artifact produced on every pull request and
read by no one. In the nightly it becomes a trend over the default branch
instead, next to the legs a change being reviewed does not wait for.

The leg itself is unchanged - same distro, version and variant, so the image
name and ccache key still match the warm cache it built. It is marked
allow-failure so a reporting leg cannot redden the nightly run that
vcpkg-cache-import requires to conclude in success.

The release-test comment loses its per-leg parenthetical: it claimed the
sanitizer leg packages, which #7666 stopped being true, and the coverage leg is
no longer in this job.

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

.github/workflows/vcpkg-cache-import.yml

@@ -4,12 +4,14 @@ name: Import vcpkg cache
 # rebuilds protobuf, openssl and abseil from source and saves them into the shared
 # cache, where every later run can restore them.
 #
-# Only master pushes are imported here: the collect step, keys.txt and the zip
-# contents all come from the workflow run being imported, so importing from an
-# unmerged pull request would let anyone who can push a branch — or a bot actor
-# such as Dependabot, whose PRs are same-repo — promote arbitrary binaries into
-# the scope that master and tag builds restore and link into signed releases.
-# Forks build untrusted code and must never reach that scope either.
+# Only master pushes and the nightly schedule run on master are imported here: the
+# collect step, keys.txt and the zip contents all come from the workflow run being
+# imported, so importing from an unmerged pull request would let anyone who can push
+# a branch — or a bot actor such as Dependabot, whose PRs are same-repo — promote
+# arbitrary binaries into the scope that master and tag builds restore and link into
+# signed releases. Forks build untrusted code and must never reach that scope either.
+# A scheduled run is the default branch at the commit a master push already built, so
+# it carries the same trust as a push.
 #
 # repository_dispatch is not used on purpose: it would also resolve to the default branch,
 # but it counts as a low-trust trigger and may only write there when it declares a
@@ -38,7 +40,7 @@ jobs:
     # the shared scope even if they somehow target the default branch.
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
+      (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
       github.event.workflow_run.head_branch == 'master' &&
       github.event.workflow_run.head_repository.full_name == github.repository &&
       !endsWith(github.event.workflow_run.actor.login, '[bot]') &&