ci: preserve SCA compatibility without ONNX

[XuPeng-SH]

What changed

Follow up #444 so the reusable SCA workflow follows the native dependency contract of the checked-out MatrixOne branch instead of always imposing current main's ONNX requirement.

• Detect whether thirdparties/Makefile exposes the onnxruntime target.
• Require, restore, validate, and post-check ONNX only for MatrixOne generations that declare that target.
• Skip Resolve PR license scope on the legacy make static-check path, where its outputs are never consumed.

Why

matrixorigin/CI/.github/workflows/ci.yaml@main is also consumed by maintenance branches. MatrixOne 4.1-dev has the other native SCA prerequisites and builds cgo/libmo.a plus cgo/libmo.so, but predates the ONNX target. After #444, an exact native cache for that branch could never be considered usable and the post-build ONNX assertion would deterministically fail.

The license-scope action was also invoked unconditionally even though legacy branches exit through make static-check. That added an unnecessary GitHub API dependency and latency without changing the result.

Behavior matrix

MatrixOne generation	ONNX target	Result
main, 4.2-dev	yes	Preserve #444 behavior: ONNX remains part of cache validation, fallback restore, build input, and post-build verification.
4.1-dev	no	Validate/build the branch's actual native contract and skip ONNX-only work.
legacy static-check path	independent	Skip PR license-scope API resolution and run the existing complete make static-check fallback.

This is intentionally scoped to the regression introduced by #444. Older 2.x branches already lack other native prerequisites required by the reusable workflow; this PR does not claim to restore that pre-existing compatibility.

Risk and performance

• Current ONNX-capable branches retain the same strict artifact checks and verified fallback behavior.
• A missing or corrupt required ONNX artifact still forces rebuild/failure; the requirement is relaxed only when the checked-out MatrixOne Makefile does not define ONNX.
• Legacy jobs avoid one unused GitHub API action and ONNX cache lookup, reducing external failure surface and setup latency.
• No MatrixOne product/runtime behavior is changed.

Validation

• actionlint -shellcheck= -pyflakes= .github/workflows/ci.yaml
• node --test actions/resolve-sca-license-scope/scope.test.js (11/11 passed)
• bash actions/restore-sca-analysis-cache/cache-state.test.sh
• bash actions/restore-sca-analysis-cache/environment-hash.test.sh
• Queried the live thirdparties/Makefile on main, 4.2-dev, and 4.1-dev: ONNX is present on the first two and absent on 4.1-dev.
• Verified 4.1-dev's CGo Makefile still owns both libmo.a and libmo.so outputs.