Add octo-sts trust policy for validation PR comments

[AAraKKe]

What does this PR do?

Adds an octo-sts trust policy (self.validate.pull-request.sts.yaml) that grants the validation workflow permission to post PR comments with validation results.

This policy is a prerequisite for #23249, which replaces the 25 sequential validation steps with a parallel ddev validate all command that posts structured failure reports as PR comments.

Motivation

The validation workflow needs pull_requests: write to post comments on PRs. The octo-sts action exchanges an OIDC token for a scoped GitHub token using this trust policy, which is more secure than using secrets.GITHUB_TOKEN with broad permissions.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged