[CI] Rebalance host unit-test jobs and document what runs when (#74386)

* [CI] Rebalance host unit-test jobs

- Move the ICD/ARL/rotating-id (all_features) unit tests to nightly.
- Drop the gcc 'main' unit-test job; gcc_debug in build.yaml now runs
  the unit tests on PRs and builds the silabs platform tests.
- Run mbedTLS ASan unit tests next to PSA, gated on crypto-related
  paths, with the path filter ahead of bootstrap.

* [CI] Comment chip_build_all_platform_tests in gcc_debug

* [CI] Bootstrap gcc_debug with unit_tests submodules

* [CI] Run gcc_debug no-logging tests on PRs only

* [CI] Run gcc_debug no-logging build on PRs only

* [CI] Bootstrap crypto backend job without unit_tests submodules

* [CI] Document host unit-test CI coverage

Add docs/ci-cd/host_unit_tests.md, a table of which unit-test
configurations run on PRs, master pushes and nightly, and why.

scripts/tools/list_unit_test_steps.py lists every workflow step that
runs unit tests into docs/ci-cd/host_unit_tests.steps.txt; --check
reports when the workflows no longer match the snapshot and --update
regenerates it.

* [CI] Drop unused msan case from the master sanitizer loop

The loop only iterates asan, tsan and ubsan; MSan runs in nightly.yaml.

* [CI] Check the unit-test steps snapshot in lint

* [CI] Revert unit-test steps snapshot to before the msan change

Temporary: shows the lint check failing on a stale snapshot.

* [CI] Regenerate unit-test steps snapshot

Picks up the msan removal and the nightly crypto-backend ASan job from
master, and adds that job to host_unit_tests.md.

* [CI] Rename unit-test steps snapshot and mark it generated

host_unit_tests.generated.txt now starts with a header naming the
script that writes it.

* [CI] Stop the crypto job at the first failed backend

Matches the other multi-build jobs; mbedTLS no longer builds next to a
failed PSA output.

* [CI] Record path triggers and path filters in the unit-test steps snapshot

The snapshot now lists paths/paths-ignore on workflow triggers and the
dorny/paths-filter lists that each test step's condition reads, so a
change to either fails the lint check.

* [CI] Record full trigger config in the unit-test steps snapshot

Every trigger setting except inputs is now written out (types,
branches-ignore, schedule cron, ...), replacing the per-key list.

* Gate master pushes of the crypto backend unit tests on the path filter

nightly.yaml already runs the PSA and mbedTLS unit tests on the full
tree every night, so running them on every master push repeated that
work. Master pushes now follow the same crypto path filter as PRs.
Release-branch pushes still always run, since scheduled workflows do
not run on release branches.

dorny/paths-filter calls git on push events and runs before bootstrap,
so mark the workspace as a safe git directory first.

* Point the nightly crypto backend comment at host_unit_tests.md

* Apply the crypto path filter to release-branch pushes as well

* Drop the safe.directory step before dorny/paths-filter

The pinned dorny/paths-filter (v4.0.3) already retries git with a
temporary safe.directory entry when the workspace is owned by another
user (dorny/paths-filter#317), so the extra step is not needed.

* Reset gn args when a later gn_gen.sh call has none

A job that runs gn_gen.sh with --args and later runs it with default
arguments kept the earlier arguments in the snapshot.

* Point the crypto and various-features unit-test jobs at host_unit_tests.md

* Reword the host_unit_tests.md pointer comments