feat(task): pass scoped user secret names

[michaelbuchar]

Forward optional secret allowlists and step-local REANA hints from CWL workflows so job submissions preserve workflow defaults, step overrides, and the documented omitted-versus-empty semantics.

Closes reanahub/reana#978

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 29.54%. Comparing base (6a43f16) to head (83680b0).

Files with missing lines	Patch %	Lines
reana_workflow_engine_cwl/cwl_reana.py	81.81%	2 Missing ⚠️
reana_workflow_engine_cwl/main.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master     #319       +/-   ##
===========================================
+ Coverage   17.47%   29.54%   +12.06%     
===========================================
  Files          10       10               
  Lines         578      589       +11     
===========================================
+ Hits          101      174       +73     
+ Misses        477      415       -62     

Files with missing lines	Coverage Δ
reana_workflow_engine_cwl/tasks.py	0.00% <ø> (ø)
reana_workflow_engine_cwl/main.py	0.00% <0.00%> (ø)
reana_workflow_engine_cwl/cwl_reana.py	39.58% <81.81%> (+21.12%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[tiborsimko]

🤖 PR319-01: Modified files omit the current copyright year (NIT)

reana_workflow_engine_cwl/main.py and reana_workflow_engine_cwl/tasks.py are modified in 2026, but their copyright headers currently end in 2025 and 2021 respectively. The repository convention is to include the year of each substantive modification.

Suggested fix — add 2026 to both copyright headers.

[tiborsimko]

🤖 Cross-component note for PR546-07: align CWL runtime hint resolution with sidecar discovery

The corresponding commons review found that packed-CWL sidecar discovery and ReanaPipelineJob._get_hint() resolve inherited REANA hints differently. Commons currently models step → tool and omits the Workflow node, while the runtime job scans cwltool's inherited workflow → step → tool list from the beginning. A workflow-only secret_names hint therefore scopes the job but leaves the sidecar at None (all secrets), and a step cannot narrow a conflicting workflow-level value.

The runtime resolver in this PR is one half of that contract. Its forward scan also governs compute_backend, kerberos, voms_proxy, rucio, kubernetes_uid, and the other REANA-specific fields, so changing precedence requires coordinated coverage beyond secret_names.

Suggested fix — coordinate this PR with the shared resolver proposed in PR546-07 so runtime job construction and packed-workflow discovery use the same explicitly defined workflow/step/tool precedence. Add packed-CWL regressions for workflow-only and conflicting workflow/step/tool hints, including a shared tool invoked from steps with different local values.