[Backport 3.7] Onboard new backport-pr re-usable github workflow (OpenSearch)

[opensearch-ci-bot]

Backport a6387ac from #22310.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 1251412.

Path	Line	Severity	Description
.github/workflows/backport.yml	11	high	External reusable workflow dependency added: opensearch-project/opensearch-build@58f2e51. Per mandatory rule, all external workflow/dependency references must be flagged regardless of apparent legitimacy. The commit pin is good practice but authenticity of that commit in the external repo cannot be verified here.
.github/workflows/backport.yml	9	medium	The original workflow explicitly guarded against pull_request_target abuse with a comment citing GitHub security docs: it only ran on *merged* PRs. That guard (github.event.pull_request.merged check) has been removed. pull_request_target runs with target-repo secrets even for fork PRs, so if the reusable workflow does not re-implement this check, unmerged fork PRs labeled 'backport' could trigger the workflow with secret access.
.github/workflows/backport.yml	13	medium	Secret OPENSEARCH_CI_BOT_TOKEN is forwarded unconditionally to the external reusable workflow. The previous workflow used a short-lived GitHub App token scoped per installation; a bot token is typically longer-lived and broader in scope. Passing it to an external workflow increases the blast radius if that workflow's commit is ever replaced with a malicious one.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 0 | High: 1 | Medium: 2 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[peterzhuamazon]

Test completed, closing.