perf: download actions as archives once per job (#1316)

Each step refreshed its own clone of an action, so a composite using one action repository ten times fetched it ten times per job, and a single network error failed the job.

Like actions/runner, a job now downloads each action repository and ref once, as an archive extracted into a directory per commit. Each action still gets its own copy in the job container. This restores the per-job dedupe of https://gitea.com/gitea/runner/pulls/1178, which only reached a since-deleted branch.

How a download works:

1. The action URL is taken after `insteadOf` rewriting, as git would use it.
2. The archive comes from `<url>/archive/<ref>.tar.gz`, or from codeload.github.com for github.com, as for actions/runner.
3. A cached tag or branch is revalidated with its ETag, which GitHub and Gitea 28+ answer with a 304. A cached commit pin needs no request.
4. Transient failures (5xx, 408, 429 honouring `Retry-After`, dropped transfers) are retried three times with a 10 to 30 second backoff.
5. Git takes over, cloning and exporting the commit into the same directory layout, when the URL is not HTTP(S), the ref is a short commit, the host serves no usable archive, the host cannot be connected to, or the retries run out.

Median of 3 runs, git (shallow clone, then fetch) against archives, on a cold and a warm cache:

| Action | git cold | git warm | archive cold | archive warm |
|---|---|---|---|---|
| github.com actions/checkout@v4 | 937ms | 726ms | 286ms | 171ms |
| github.com actions/cache@v4 | 1006ms | 801ms | 516ms | 161ms |
| github.com actions/setup-node@v4 | 1046ms | 786ms | 463ms | 156ms |
| gitea.com actions/checkout@v4 | 2007ms | 1165ms | 667ms | 222ms |

The action cache layout changes, so existing caches download once more.

*Written by Claude.*

Fixes: https://gitea.com/gitea/runner/issues/1220
Reviewed-on: https://gitea.com/gitea/runner/pulls/1316
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

internal/pkg/config/config.example.yaml

@@ -91,11 +91,12 @@ runner:
   # it replaces https://github.com with the value here, which is useful for some special network environments.
   #github_mirror: ''
   # Extra HTTP headers for runner API requests to Gitea, e.g. reverse proxy authentication.
-  # Not used for action clones, artifacts, job summaries or jobs. Runner headers take precedence.
+  # Not used for action downloads, artifacts, job summaries or jobs. Runner headers take precedence.
   # Dropped on redirects to another hostname, or to HTTP if the instance URL uses HTTPS.
   #extra_headers:
   #  X-Proxy-Token: 'example'
-  # When true (the default), fetch only the requested ref of an action repository (e.g. actions/checkout@v4) at depth 1 instead of cloning every branch's full history.
+  # When true (the default), clone only the requested ref at depth 1 instead of every branch's full history. Actions download as
+  # archives, so this applies to reusable workflows and to actions whose host serves no archive of them.
   # Set to false to clone the full history.
   #action_shallow_clone: true
   # When true (the default), inject the ACT=true environment variable into jobs.