CI: Add Gerrit bypassable RTDv3 verify workflow

[ModeSevenIndustrialSolutions]

Summary

Adds an organization-level bypassable required workflow that verifies
Read the Docs (RTDv3) documentation builds for Gerrit patchsets, voting
with a dedicated bypassable service account so maintainers can override
the result when necessary.

Part of the effort to modernise the Linux Foundation Gerrit CI and
standardise on the centrally-managed reusable workflows in
lfit/releng-reusable-workflows.

Design

Thin dispatcher (on: workflow_dispatch, invoked by the Gerrit → GitHub
integration):

1. Clear bypassable vote — clears the prior vote using the bypassable
   service account.
2. Read the Docs verify — delegates to the shared reusable
   gerrit-compose-required-rtdv3-verify.yaml@v0.8.1, forwarding the RTD
   API token.
3. Set bypassable vote — votes the aggregated conclusion back to
   Gerrit.

Unlike ONAP's equivalent, this deliberately omits the bespoke inline
doc-rules-compose logic — all shared behaviour stays in the reusable,
per the goal of standardising on centrally-managed CI.

Notes / follow-ups

• All uses: references are SHA-pinned to their latest releases.
• Passes zizmor --persona=auditor with zero findings. The
  secrets-outside-env allow-list is provided by the companion config PR
  (CI: Add zizmor auditor configuration #45), which should merge first.
• Org provisioning required (admin): relies on LFIT_GERRIT_SERVER,
  LFIT_GERRIT_KNOWN_HOSTS, LFIT_GERRIT_SSH_BYPASSABLE_USER /
  LFIT_GERRIT_SSH_BYPASSABLE_PRIVKEY, the RTD_TOKEN secret, and the
  shared reusable's vars.GERRIT_URL. A repository Ruleset must map
  this workflow as a bypassable required check for the Gerrit-mirrored
  docs repositories.

Validation

• actionlint → clean
• yamllint → clean
• zizmor --persona=auditor --offline → no findings

[tykeal]

We do not have any sort of RTD bypassable voter for RE repositories. This is a no-op type job. All RE repos must pass all tests (including any related to docs) to be mergable.