Add workflow to update latest and default branches

[KyleFromNVIDIA]

Tested in rapidsai/cudf#18308.

[bdice]

This looks like a good start. It seems the actual update step is still TODO?

From a policy perspective, here is the behavior I am expecting.

• latest should point to the latest-available branch, like 25.06 right now (even though it is not yet the default branch)
• default should point to the current default branch, like 25.04 right now

Most of the development cycle, latest and default will be the same. When burndown begins, latest will point to the newly created branch.

[bdice]

I left a couple suggestions but I am okay with the current state, if you disagree with my proposals or don't think they are worthwhile improvements. I'll approve this but am happy to take a second pass later.

[KyleFromNVIDIA]

@bdice I've taken your feedback, removed an unnecessary API call, and added an all input to update all branches instead of just the one that got pushed. You can see the results here.

[bdice]

Love it! This is really nice.

[bdice]

@KyleFromNVIDIA Following up on this -- is there an issue tracking how this will be rolled out / used in RAPIDS? I don't see one cross-linked here.

[KyleFromNVIDIA]

We decided to only run this workflow on shared-workflows itself. AFAIK, it's not needed anywhere else. I'll open a PR to start this.

Looks like I'd already opened #320.

[KyleFromNVIDIA]

Oh, but we also realized that the token in the workflow won't have permission to push to protected branches, and we need an app or something.