Reach nested credentials, and lint workflow files

[norman-abramovitz]

Nested credential access (#23, #11)

CredentialString does a single top-level lookup and asserts the value is a
string, so a credential like protocols.amqp.uri was unreachable and a
non-string leaf like protocols.amqp.ssl returned false.

• Service.Credential(keys ...string) (interface{}, bool) walks the
  credentials one key at a time and returns the value with its own type —
  string, bool, the float64 a JSON number decodes to, or a nested map or
  slice.
• Service.CredentialPath("protocols.amqp.uri") is the dot-delimited form,
  built on Credential.

Keys are passed separately in the primitive because VCAP_SERVICES credentials
are broker-defined free-form JSON and a key may itself contain a dot — jdbc.url
is a common one. The dotted form splits on every dot and so cannot address those;
the doc comment states the limitation and points at Credential.

CredentialString is deliberately untouched: making it path-aware would silently
change behavior for any existing caller whose key contains a dot.

Issue #11 needed no code — its payload decodes cleanly today, since Credentials
is map[string]interface{}. That payload is pinned as a regression test.

API impact — gorelease -base=v1.19.1:

## compatible changes
(*Service).Credential: added
(*Service).CredentialPath: added

# summary
Suggested version: v1.20.0

Purely additive; no existing signature or behavior altered.

actionlint

Workflow files are executable configuration, and YAML validity says nothing about
whether they run. Last release cycle a duplicate env: key made CI parse to zero
jobs. make actionlint catches that class, auto-installing on demand the way
mk/security.mk does for govulncheck and gosec.

It is wired into make check and listed as its own step in the CI quality-gates
job — that job runs the gates individually rather than calling make check, because
golangci-lint comes from the action instead of make lint.

Verification

• make check clean, make test-race passes
• coverage 89.4% → 90.9%

Closes #23
Closes #11