feat(actions): Add Actions API endpoints for workflow run management and logs (#35382)

Implements the missing REST API endpoints for Actions workflow run
management:

1. `POST /actions/runs/{run}/cancel` cancels a run and its jobs, `409`
when it already finished
1. `POST /actions/runs/{run}/approve` approves a run awaiting approval,
idempotent, `409` when it never awaited one
1. `GET /actions/runs/{run}/logs` downloads the latest attempt's job
logs as a zip archive

`ActionWorkflowRun` gains `created_at`, `updated_at` and the `jobs_url`,
`logs_url`, `artifacts_url`, `cancel_url` and `rerun_url` fields, and
now always emits `conclusion` and `head_branch`.

Cancellation is shared with the web handler in `services/actions`.

Fixes https://github.com/go-gitea/gitea/issues/35176
Fixes https://github.com/go-gitea/gitea/issues/36554

---------

Co-authored-by: Claude Sonnet 4.6 <claude-sonnet-4-6@anthropic.com>
Co-authored-by: OpenCode Agent <opencode@rossgolder.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/repository/generate.go

@@ -12,7 +12,6 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
 	"sync"
@@ -42,8 +41,7 @@ type expansion struct {
 }
 
 var globalVars = sync.OnceValue(func() (ret struct {
-	defaultTransformers    []transformer
-	fileNameSanitizeRegexp *regexp.Regexp
+	defaultTransformers []transformer
 },
 ) {
 	ret.defaultTransformers = []transformer{
@@ -55,10 +53,6 @@ var globalVars = sync.OnceValue(func() (ret struct {
 		{Name: "UPPER", Transform: strings.ToUpper},
 		{Name: "TITLE", Transform: util.ToTitleCase},
 	}
-
-	// invalid filename contents, based on https://github.com/sindresorhus/filename-reserved-regex
-	// "COM10" needs to be opened with UNC "\\.\COM10" on Windows, so itself is valid
-	ret.fileNameSanitizeRegexp = regexp.MustCompile(`(?i)[<>:"/\\|?*\x{0000}-\x{001F}]|^(con|prn|aux|nul|com\d|lpt\d)$`)
 	return ret
 })
 
@@ -340,7 +334,9 @@ func (gro GenerateRepoOptions) IsValid() bool {
 func filePathSanitize(s string) string {
 	fields := strings.Split(filepath.ToSlash(s), "/")
 	for i, field := range fields {
-		field = strings.TrimSpace(strings.TrimSpace(globalVars().fileNameSanitizeRegexp.ReplaceAllString(field, "_")))
+		field = util.PathNameValidator().InvalidChars.ReplaceAllString(field, "_")
+		field = util.PathNameValidator().InvalidNames.ReplaceAllString(field, "_")
+		field = strings.TrimSpace(field)
 		if strings.HasPrefix(field, "..") {
 			field = "__" + field[2:]
 		}