Document job callbacks and fire and forget bare metal runs

[epompeii]

The docs for callbacks and fire and forget bare metal runs, in all nine languages.

• bencher run: new chunks for --callback-url, --callback-header, --callback-body, --job, and --ci-callback-token. The body template section gives the five context values, the grammar, and every limit, and says that without a template the callback sends the report. The receiver notes cover dedupe on job.uuid, https only with private addresses refused, the paid plan requirement, and where secrets belong. --detach, --github-actions, and the job wait options point at them. --github-actions says an empty token is refused before the run starts, and --callback-header says to quote the header.
• GitHub Actions how-to: a fire and forget section with both workflows. It covers the token each workflow takes and why, the check's outcome in every case, the dispatch token's scope, expiry, and rotation, and workflow 2 passing the payload through env:.
• Server config: the secret_key row says the key also seals pending callbacks, and that changing it drops them.
• Glossary: Unknown, Callback, and Attach, and the Job entry's states.
• Changelog: the feature, two breaking changes (a detached GitHub Actions run now needs a callback, and an empty --github-actions token is refused before the run), and the fix that makes a failed or canceled job's check fail instead of pass.

Needed for #1046