Sync pr.yaml with standard CI template

[Chris-Wolfgang]

Summary

• Add security header comment explaining pull_request vs pull_request_target, persist-credentials, and trusted config fetch rationale
• Switch gitleaks from gitleaks-action@v2 to CLI invocation (v8.24.0) for pull_request compatibility
• Add trusted configuration file fetch step (.editorconfig, Directory.Build.props, etc. from main branch) after Checkout in all stages and security scan
• Add 3.1.x to Linux and Windows .NET SDK setup
• Add netcoreapp3.1 to Linux test TFM extraction and Windows TFM filter regex
• Fix libssl installation to use APT (focal-security repo) instead of plain wget download
• Fix DevSkim: remove continue-on-error and -E flag; add exit 1 on critical/high findings
• Add CODECOV_MINIMUM: 90 env var at workflow level
• Add coverage collection, report generation, and threshold enforcement to Windows (Stage 2a) and macOS (Stage 2b) stages
• Update Linux project filter to include netcoreapp|netstandard patterns
• Replace while-read with mapfile for test project discovery on Linux
• Fix concurrency block formatting (was on same line as branch list)
• Use ${CODECOV_MINIMUM:-90} in coverage threshold checks

Test plan

• Verify secrets-scan job runs gitleaks CLI successfully
• Verify trusted config fetch works in Linux, Windows, and macOS stages
• Verify .NET 3.1 SDK installs on Linux and Windows
• Verify DevSkim scan fails the job on critical/high findings
• Verify coverage gates work on all three OS stages
• Verify concurrency cancels in-progress runs correctly

🤖 Generated with Claude Code