Use reusable Splunk agreements workflow

[jcsco]

Related to #46

---

Before the change?

• The repository defined its CLA and Code of Conduct jobs locally with contributor-assistant/github-action@v2.3.0.
• Both jobs failed while reading splunk/cla-agreement with Could not retrieve repository contents. Status: 401.
• The workflow granted write access to repository contents and actions.

After the change?

• Delegate both checks to Splunk's shared reusable-agreements.yaml@v1.7.2 workflow, following the pattern used by splunk-connect-for-snmp.
• Map the centrally managed PAT_CLATOOL secret to the reusable workflow's PERSONAL_ACCESS_TOKEN input.
• Reduce caller permissions to the least-privilege set required by the shared workflow.
• Pick up contributor-assistant/github-action@v2.6.1 through the pinned reusable workflow.

Pull request checklist

• Workflow syntax validated with actionlint v1.7.7
• Docs reviewed; no documentation changes are needed

Validation Output

actionlint .github/workflows/cla.yaml

# no findings

The agreement jobs on this PR will still use the existing base-branch workflow because pull_request_target loads workflow definitions from the base branch. The reusable workflow will take effect after this change is merged.

Does this introduce a breaking change?

• Yes
• No

---