fix(actions): evaluate job-level if: before concurrency check (#39437)

Gitea doesn't evaluate a job's `if:` before checking the job's
concurrency group, which causes a job that should have been skipped to
incorrectly cancel other jobs in the same concurrency group.

This PR makes Gitea decide `if:` for every job before it becomes
waiting, including jobs without `needs` at insertion, on approval and on
rerun. A skipped job therefore no longer takes part in job concurrency
or holds a max-parallel slot, and a reusable caller whose `if:` is false
is no longer expanded on approval or rerun. An invalid `if:` skips the
job with an error summary.

After this PR, Gitea decides all jobs' `if:` expressions and sends `if:
always()` to the runner, so the runner no longer needs to evaluate a
job's `if:` again ([gitea/runner
`run_context.go`](https://gitea.com/gitea/runner/src/commit/81add274599355ec1838b6ebe45804890d40bab9/act/runner/run_context.go#L1195)).

---------

Co-authored-by: silverwind <me@silverwind.io>

tests/integration/api_actions_run_test.go

@@ -208,6 +208,13 @@ func TestAPIActionsRerunWorkflowRun(t *testing.T) {
 	writeToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
 	readToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
 
+	for _, jobID := range []int64{198, 199} {
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: jobID})
+		job.WorkflowPayload = minimalConcurrentWorkflowPayload(job.JobID)
+		_, err := actions_model.UpdateRunJob(t.Context(), job, nil, "workflow_payload")
+		require.NoError(t, err)
+	}
+
 	t.Run("RunLogs", func(t *testing.T) {
 		// run 795 (workflow "test.yaml") has job 198 "job_1" on task 53 and job 199 "job_2" on task 54
 		seedTaskLogs(t, 53, "hello from job_1")
@@ -522,6 +529,7 @@ func testAPIActionsApproveWorkflowRun(t *testing.T) {
 		require.NoError(t, db.Insert(t.Context(), &actions_model.ActionRunJob{
 			RunID: run.ID, RepoID: run.RepoID, OwnerID: run.OwnerID, CommitSHA: run.CommitSHA,
 			Name: "job1", Attempt: 1, JobID: "job1", Status: actions_model.StatusBlocked, RunsOn: []string{"ubuntu-latest"},
+			WorkflowPayload: minimalConcurrentWorkflowPayload("job1"),
 		}))
 		return run
 	}