refactor: extract pull request release notes action

[vitormattos]

Summary

Extracts the pull-request resolution and Markdown change-list logic from the nightly workflow into a reusable, tested composite action.

The new release-notes-from-pull-requests action:

• enumerates commits from a Git range;
• resolves pull requests associated with each commit;
• prefers merged pull requests targeting the requested branch;
• deduplicates pull requests that contain multiple commits;
• preserves direct commits as fallbacks;
• normalizes untrusted PR titles before rendering Markdown;
• supports GitHub Enterprise URLs;
• does not forward the GitHub authorization header across redirects;
• uses only Python's standard library and the existing Git checkout.

This PR intentionally adds the reusable action and its unit tests first. After it is merged, the nightly workflow can reference the merged immutable SHA in a follow-up PR instead of pinning to an unmerged branch commit.

Tests

Adds unit coverage for:

• branch-specific PR selection;
• ignoring unmerged PRs;
• PR deduplication;
• direct commit fallback;
• multiline title normalization;
• GitHub Enterprise API/server URLs;
• authorization-header redirect hardening;
• generic action contract.

Signed-off-by: Vitor Mattos vitor@php.rio