ci: add Engineering Kanban shared workflow

[muhlemmer]

Adds the shared reusable workflow that all Zitadel repositories will call to automatically add new issues and community PRs to the Engineering Kanban project.

Individual repositories will reference this via a thin caller workflow at .github/workflows/kanban.yml. All logic lives here so it only needs to change in one place.

[Copilot]

Pull request overview

Adds a reusable GitHub Actions workflow intended to be called by other Zitadel repositories to automatically add newly-created issues and community PRs to the Zitadel Engineering Kanban (GitHub Project 15).

Changes:

• Introduces a workflow_call reusable workflow with inputs for an issue URL and PR URL.
• Generates a GitHub App token and uses gh project item-add / gh project item-edit to add the item to Project 15 and set a single-select field.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fforootd]

I left a few inline comments around the reusable workflow contract and runtime behavior.

[fforootd]

The PR description says the shared workflow adds “community PRs” and that all logic lives here, but this condition accepts any PR URL the caller passes. If thin caller workflows pass github.event.pull_request.html_url on pull_request_target.opened, internal PRs will be added too. Can we move the existing dependabot/staff/engineer filtering into this shared workflow, or make the caller contract explicit that callers must only pass community PR URLs?

[fforootd]

Because this is a reusable workflow_call, these app secrets should either be declared under on.workflow_call.secrets as required inputs or every caller must use secrets: inherit. Named secret passing fails unless the called workflow declares the secret names, so making the secret contract explicit would make the thin caller workflows less fragile.

[fforootd]

These workflow inputs are interpolated directly into a shell script. The current intended values are GitHub-generated URLs, but reusable workflow inputs are still a sharp edge if a future caller passes anything user-controlled. Safer pattern: assign the expression to an environment variable, then use --url "$ISSUE_URL" here and the same pattern for pr_url below.