ci(sonarqube): stop analysing pull requests into a shared <repo>-pr project

[BryanFRD]

Closes #329.

Pull requests analysed into a <repo>-pr sandbox project, and to keep two of them from overwriting each other the job serialised every PR of a repo behind one job-level concurrency group with cancel-in-progress: false. GitHub keeps a single pending job per group, so as soon as a third PR was open the waiting one was cancelled with zero steps. Sonar being a required check, that blocked the PR until someone re-ran it, and the re-run could lose the same race.

SonarQube Community has no pull request analysis, so there is no correct way to keep a per-PR picture without paying for that race. Pull requests are no longer analysed:

• reusable-sonarqube-scan: the job is skipped on pull_request, the project key is always the repository's own (no more <repo>-pr), and the job-level concurrency group goes. So do the three PR-only steps (wait for ingestion, diff against the default branch, delta comment) and the pull-requests: write they needed.
• reusable-ci-{rust,node,astro,go}: the sonarqube job skips on pull_request too. They call the scan at a pinned SHA, so without this the fix would need two digest bumps to reach a product repo instead of one. Their pull-requests: write grant stays until that internal pin moves, because the pinned version still declares it and a caller granting less fails at startup.

Default-branch pushes and tags analyse exactly as before, into the project named after the repository.

Already done outside this diff: the SonarQube check is removed from the required checks of the 18 repo rulesets that listed it (30 contexts in total), so blocked pull requests stop waiting on it now rather than after each repo bumps its .github pin.

The <repo>-pr projects that already exist on sonar.ferrlabs.com are left in place. Nothing writes to them any more.

[ferrfleet]

Checked out the head and grepped the callers: nothing in reusable-ci-{rust,node,astro,go} has needs: sonarqube, and there is no aggregate gate job that asserts its result, so the skipped job breaks no dependency. SONAR_HOST, SONAR_TOKEN and fetch-depth: 0 are all still used by what remains. Dropping pull-requests: write from the called workflow while callers still grant it is fine (the token is the intersection), and keeping the grant in the callers is required as long as they pin 2883414, which still declares it.

Nit: nothing in the four caller files records why a job that can no longer run on a pull request keeps pull-requests: write. The reason only lives in this PR description, so the next person tidying reusable-ci-go.yml will drop it and break every caller still on the old pin, with a startup error rather than a test failure. One comment line above each grant pointing at the pin would cost nothing; not worth a suggestion block since it is the same edit in four files.

workflow_dispatch on a non-default branch still analyses into the repo's own project and overwrites main's picture, but that predates this change and is unrelated.