[TASK] Add ADR-003: Versioning strategy for shared workflow references

[CybotTM]

Summary

Proposes a versioning strategy for how consumer repositories should reference
shared reusable workflows: use @main, with tags only for breaking changes.

This ADR is in "Proposed" status and requests feedback from maintainers.

Key argument

SHA-pinning shared workflows reintroduces the per-repo maintenance burden that
shared workflows are designed to eliminate. With @main, a fix to the shared
workflow automatically benefits all ~29 consumer repos. With SHA pins, every
consumer must be updated individually.

Context

The existing GettingStarted backport workflow uses a full SHA pin
(@bfd07ddb...), while all new migration PRs use @main. This ADR proposes
standardizing on @main with clear rationale.

Dependencies

• .github#3 (adds Documentation/Decisions/ structure and toctree)

Feedback requested

• Is @main acceptable for your workflow stability requirements?
• Would you prefer mandatory tags for all changes?
• Should branch protection rules be added to this repo?