Run tests in CI before deploying, like BioSpex #88

Bring the CI in line with BioSpex: run the tests before every deploy and on pull requests, and share one deploy workflow between production and development. Today deploy.yml deploys without running any tests, has the production and development build-and-deploy jobs copied out in full, and trusts the servers with ssh-keyscan at deploy time.

To do

• tests.yml: runs on pull requests into main and development and as a workflow_call.
  • test job: PHP 8.5, Composer cache, composer install --no-scripts, generate the APP_KEY for the run (echo 'APP_KEY=' > .env && php artisan key:generate --force, as in Generate the test APP_KEY in CI instead of committing it Biospex#531, so no key is committed), package:discover, Pint on the changed files for pull requests (vendor/bin/pint --test --diff=origin/${{ github.base_ref }}), then vendor/bin/pest --compact (Pest 4, SQLite in memory from phpunit.xml; no MongoDB service needed).
  • audit job, pull requests only: composer audit --locked. It reports but never blocks a deploy.
• deploy-environment.yml: one reusable workflow with an environment input (production / development), replacing the two copies of the build-and-deploy job in deploy.yml. It runs under the matching GitHub environment and keeps the current steps: runner IP allow-list and revoke, PHP and Composer, Yarn install and npm run production, deployment package and artifact, Deployer.
• SSH host keys: commit .github/known_hosts with both servers' keys and set StrictHostKeyChecking yes, instead of ssh-keyscan at deploy time.
• deploy.yml:
  • A tests job (calling tests.yml) that the production and development deploys both need, so a failing test stops the deploy. [skip deploy] / [no deploy] skip the tests too.
  • concurrency per branch with cancel-in-progress: false, so two quick merges can't deploy at once or calculate the same version.
  • Release notes from gh release create --generate-notes since the previous release, as BioSpex does.
• Dependabot: .github/dependabot.yml for GitHub Actions, Composer (minor and patch grouped) and npm, weekly, targeting development.
• README: describe the tests job and the known-hosts file.
• Fix whatever the first run turns up (for example, existing Pint findings only fail on changed files).

After merging

• Run Build and Deploy manually on development: the tests run first, the SSH steps connect with host-key checking on, and the site deploys.
• The production deploy from the merge runs the tests first and deploys.
• Add the test check as required in the main ruleset.

Reference: BioSpex's .github/workflows/{tests,deploy,deploy-environment}.yml, .github/known_hosts and .github/dependabot.yml on development (AustinMastLab/Biospex#524, AustinMastLab/Biospex#531). They aren't in BioSpex main yet; they're released with AustinMastLab/Biospex#538.