Secure Ruby version automation

[gauravtiwari]

What changed

• Reworks the scheduled Ruby version checker to update versions.yml through a bot-authored PR instead of relying on the default GITHUB_TOKEN to create PRs.
• Adds scripts/update-ruby-versions.py so version discovery, EOL pruning, and priority rotation are testable outside a workflow heredoc.
• Updates tracked Ruby patches to the latest ruby-build definitions currently seen by the updater: 4.0.4, 4.0.3, 4.0.2; 3.4.9, 3.4.8, 3.4.7; 3.3.11, 3.3.10, 3.3.9.
• Keeps cache-producing Ruby builds off pull requests; PRs now run only Ruby Config Validation.
• Moves the build workflow from the broad BORINGCACHE_API_TOKEN to split BORINGCACHE_RESTORE_TOKEN and BORINGCACHE_SAVE_TOKEN secrets.
• Adds validation guards so PRs fail if the cache workflow gets a PR trigger or the broad BoringCache token is reintroduced.
• Adds .boringcache.toml with the ruby/ruby workspace from boringcache onboard.
• Makes scheduled cleanup delete exact cache tags with --no-platform --no-git.

Why

The failed scheduled run pushed auto/ruby-version-bump but failed when creating the PR because repository Actions settings do not allow the default GITHUB_TOKEN to create PRs. This keeps main protected and moves write operations to the same BOT_PUBLIC_GITHUB_TOKEN pattern used by the benchmark sync repos.

Pull requests must not build or save Ruby caches, because PR-scoped runs can create tags like ruby-*-pr-2-*. The build matrix now runs only from main, schedule, or manual dispatch.

Validation

• python3 -m py_compile scripts/update-ruby-versions.py
• python3 scripts/update-ruby-versions.py with hash-idempotence check
• Ruby YAML parse of versions.yml, variants.yml, and all touched workflows
• bash -n scripts/build-ruby-variants.sh scripts/configure-platform.sh
• PR check: Ruby Config Validation passed on commit 431a473

Follow-up

• boringcache/ruby now has BORINGCACHE_RESTORE_TOKEN and BORINGCACHE_SAVE_TOKEN repo secrets from onboarding.
• boringcache/ruby does not currently expose BOT_PUBLIC_GITHUB_TOKEN as a repo or inherited org secret, so the scheduled checker needs that secret enabled before the bot PR step can run.
• The accidental -pr-2- cache tags still need cleanup with an authenticated BoringCache CLI; delete only the exact PR tags.