ci: modernize review workflow to latest standard

Forward secrets via `secrets: inherit`, add a dynamic run-name, and add a
workflow_dispatch trigger (with pr_number input) for manual re-runs plus
the allowed-tools passthrough. The review job now also runs on
workflow_dispatch (guarded off only for pull_request_target and
dependabot). Keeps the existing dependency-bump job.

Issue: CLDSRV-930

Author: delthas

.github/workflows/review.yml

@@ -1,29 +1,31 @@
 name: Code Review
+# yamllint disable rule:line-length
+run-name: "Code Review for #${{ github.event.pull_request.number || inputs.pr_number }}${{ github.event.pull_request.title && format(' : {0}', github.event.pull_request.title) }}"
+# yamllint enable rule:line-length
 
 on:
-  pull_request:
-    types: [opened, synchronize, labeled, unlabeled]
-  pull_request_target:
-    types: [opened, synchronize]
+    pull_request:
+        types: [opened, synchronize, labeled, unlabeled]
+    pull_request_target:
+        types: [opened, synchronize]
+    workflow_dispatch:
+        inputs:
+            pr_number:
+                description: Pull Request number to review
+                required: true
 
 jobs:
-  review:
-    if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
-    uses: scality/workflows/.github/workflows/claude-code-review.yml@v2
-    secrets:
-      GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
-      GCP_SERVICE_ACCOUNT: ${{ secrets.GCP_SERVICE_ACCOUNT }}
-      ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.ANTHROPIC_VERTEX_PROJECT_ID }}
-      CLOUD_ML_REGION: ${{ secrets.CLOUD_ML_REGION }}
+    review:
+        if: github.event_name != 'pull_request_target' && github.actor != 'dependabot[bot]'
+        uses: scality/workflows/.github/workflows/claude-code-review.yml@v2
+        with:
+            allowed-tools: >-
+                ${{ github.event_name == 'workflow_dispatch' && '"Bash(gh api repos/*/contents)"' || '' }}
+        secrets: inherit
 
-  review-dependency-bump:
-    if: github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]'
-    uses: scality/workflows/.github/workflows/claude-code-dependency-review.yml@v2
-    with:
-      ACTIONS_APP_ID: ${{ vars.ACTIONS_APP_ID }}
-    secrets:
-      GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
-      GCP_SERVICE_ACCOUNT: ${{ secrets.GCP_SERVICE_ACCOUNT }}
-      ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.ANTHROPIC_VERTEX_PROJECT_ID }}
-      CLOUD_ML_REGION: ${{ secrets.CLOUD_ML_REGION }}
-      ACTIONS_APP_PRIVATE_KEY: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
+    review-dependency-bump:
+        if: github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]'
+        uses: scality/workflows/.github/workflows/claude-code-dependency-review.yml@v2
+        with:
+            ACTIONS_APP_ID: ${{ vars.ACTIONS_APP_ID }}
+        secrets: inherit