ci: test the Ruby event source

[ryanduguid]

Summary

• test the event source instead of checking out XeroAPI/xero-ruby on every pull request
• pin both actions and grant the workflow read-only repository access
• exercise Ruby 3.2 and 3.4 on Linux plus Ruby 3.2 on Windows
• make Ruby 3.2 the exact package floor declared by companion metadata PR Set the tested Ruby runtime floor #387
• use a cross-platform Ruby compile check and build the gem after lint/tests
• bound job runtime while keeping matrix failures independent

Validation

• actionlint .github/workflows/build-test-lint.yml
• compiled every Ruby file under lib/ and spec/ with Ruby 3.2.11
• git diff --check

The full dependency-backed matrix is intentionally delegated to this pull request's exact-head GitHub Actions checks because native Windows gems require MSYS2, which is unavailable in the local portable Ruby environment. Until those hosted checks run, Ruby 3.2 Windows support is unverified rather than passing.