feat(actions): Add Actions API endpoints for workflow run management and logs (#35382)

Implements the missing REST API endpoints for Actions workflow run
management:

1. `POST /actions/runs/{run}/cancel` cancels a run and its jobs, `409`
when it already finished
1. `POST /actions/runs/{run}/approve` approves a run awaiting approval,
idempotent, `409` when it never awaited one
1. `GET /actions/runs/{run}/logs` downloads the latest attempt's job
logs as a zip archive

`ActionWorkflowRun` gains `created_at`, `updated_at` and the `jobs_url`,
`logs_url`, `artifacts_url`, `cancel_url` and `rerun_url` fields, and
now always emits `conclusion` and `head_branch`.

Cancellation is shared with the web handler in `services/actions`.

Fixes https://github.com/go-gitea/gitea/issues/35176
Fixes https://github.com/go-gitea/gitea/issues/36554

---------

Co-authored-by: Claude Sonnet 4.6 <claude-sonnet-4-6@anthropic.com>
Co-authored-by: OpenCode Agent <opencode@rossgolder.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/actions/log.go

@@ -192,16 +192,22 @@ func OpenLogs(ctx context.Context, inStorage bool, filename string) (io.ReadSeek
 		return nil, fmt.Errorf("storage open %q: %w", filename, err)
 	}
 
-	var reader io.ReadSeekCloser = f
 	if strings.HasSuffix(filename, ".zst") {
-		r, err := zstd.NewSeekableReader(f)
+		reader, err := zstd.NewSeekableReader(f) // reads the seek table, so a lazily opened object already fails here
 		if err != nil {
-			return nil, fmt.Errorf("zstd NewSeekableReader: %w", err)
+			f.Close()
+			return nil, fmt.Errorf("zstd NewSeekableReader %q: %w", filename, err)
 		}
-		reader = r
+		return reader, nil
 	}
 
-	return reader, nil
+	// object storage opens lazily, force a missing object to surface before the caller commits a response
+	if _, err := f.Seek(0, io.SeekStart); err != nil {
+		f.Close()
+		return nil, fmt.Errorf("storage open %q: %w", filename, err)
+	}
+
+	return f, nil
 }
 
 func FormatLog(timestamp time.Time, content string) string {