(cherry picked from commit 4d00c68)

All other workflows do - and most importantly actionlint only runs on
.yml files!

(cherry picked from commit fcb24b9)

mergedSha is available from needs.get-merge-commit, not needs.attrs.
Actionlint rightfully complains about that.

The code still works as expected because nixpkgs/ is checked out at
mergedSha, so the diff will be between mergedSha and baseSha.

(cherry picked from commit 72fd375)

Same top-level ordering of keys / empty lines and same indentation for
yaml lists. One blank line between each step.

Makes it easier to read and compare the workflows.

(cherry picked from commit 88afad8)

The eval-aliases job is independent of attrs already.

(cherry picked from commit 94c4c7b)

No need for that limitation, which only artifically limits test-ability
of CI in forks.

Some other workflows like backports, cherry-pick checks and periodic
merges are very specific to the release branches and don't need to be
run in forks.

(cherry picked from commit b64d5e1)

It seems odd to exclude PRs against release branches for those checks -
especially when not excluding PRs against staging-** variants at the
same time.

(cherry picked from commit 58f8c53)

We currently use two different "base" commits, but the same name. One of
them is the commit in which context the pull_request_target runs. The
other is the parent of the merge commit. Those are **not** necessarily
the same - see README introduced in the next commit for details.

Renaming one of them for clarity. Since the pull_request_target related
base commit is also called like that in GitHub Actions terminology, we
rename the other. The best I could come up with is "target".

(cherry picked from commit 3e9f5c0)

This introduces some basic concepts used in these workflows and a common
terminology.

At the same time we remove some of the comments from various workflow
files, because they are assumed to be "general knowledge" through the
README.

(cherry picked from commit 9ea7422)