ci: add on-demand autotls beekeeper workflow

[gacevicljubisa]

Checklist

• I have read the coding guide.
• My change requires a documentation update, and I have done it.
• I have added tests to cover my changes.
• I have filled out the description and linked the related issues.

Description

Adds .github/workflows/beekeeper-autotls.yml — a manually triggered workflow
for the AutoTLS beekeeper checks (ci-pingpong, ci-full-connectivity,
ci-retrieval, ci-autotls) against the local-dns-autotls cluster.

The AutoTLS cluster is slow to start, so this workflow deliberately does not
run on push/PR commits. It runs only on workflow_dispatch, from the Actions
tab via "Run workflow":

• Branch under test — pick it in the "Use workflow from" dropdown, or pass
  an explicit ref input.
• beekeeper_branch input (default master) — beekeeper tooling/checks branch.
• beelocal_branch input (default main) — beelocal cluster-setup branch.

The branch inputs let you point at the beekeeper/beelocal feature branches that
define local-dns-autotls / ci-autotls without editing the workflow.

beekeeper.yml is left unchanged. This replaces the approach in #5350 (which
wired AutoTLS into the per-commit PR flow), so #5350 can be closed.

Open API Spec Version Changes (if applicable)

Motivation and Context (Optional)

Related Issue (Optional)

Screenshots (if appropriate):

AI Disclosure

• This PR contains code that has been generated by an LLM.
• I have reviewed the AI generated code thoroughly.
• I possess the technical expertise to responsibly review the code generated in this PR.

[gacevicljubisa]

Additionally, instead of running it manually only, we can add a merge_group: trigger alongside workflow_dispatch:. We would need to enable a merge queue on the master branch (Settings -> Rules/Branch protection), and add the "Integration tests (autotls)" job as a required status check. The queue then runs this workflow on the PR merged onto master; a failure ejects the PR from the queue and leaves it unmerged.

Trade-off: merge_group runs cannot accept the workflow inputs (those exist only for workflow_dispatch), so the queue always uses the BEEKEEPER_BRANCH / BEELOCAL_BRANCH defaults hardcoded in this file. In practice this is the correct way, because all dependecies should be merged earlier.

wdyt @acud @akrem-chabchoub ?