Surge workflow - secret availability is not tested

[briantist]

The surge workflow requires a secret, however we don't actually test that the secret is available. As a result, when a repo which uses the workflow successfully (like community.hashi_vault) is forked, the workflow in the fork fails unless the fork's owner sets a working secret.

I think the shared workflow should check for the existence of the secret first of all (GitHub does not provide a nice way to do this but I think we can compare to empty string), and it should provide an option that controls what to do when the secret is missing (skip tasks and be "successful" or fail), so that the caller can decide how to handle it.