CI: Enforce the full-URL form for new GitHub references (GH#55461)

[jbrockmendel]

Implements the pre-commit half of GH-55461, without the bulk rewrite.

GH-55461 converged 7-to-4 on the full-URL form for GitHub references, and the plan was "conforming the tests to URL - ideally with some form of pre-commit check". Conforming the tests turns out to be the expensive half: there are 12,145 short references in the tree, spelled 24 different ways, and 2,823 of the lines they sit on would exceed the line limit once a 44-character URL replaces GH#1234, so they would need their prose reflowed by hand. That is a lot of churn and git blame damage for no behaviour change.

The cheap half is worth having on its own, since it is what stops the spelling count growing to 25. This PR does only that:

• scripts/validate_gh_references.py rejects a short-form reference (GH#1234, GH 1234, GH-1234, GH1234, gh-1234, GH: #1234, ...) and points at https://github.com/pandas-dev/pandas/issues/1234 instead.
• scripts/gh_reference_baseline.txt grandfathers everything already in the tree: 9,043 distinct (file, issue number) pairs across 998 files. Keying on the issue number rather than the line means the baseline survives line moves and edits to the prose around a reference, so it only fires on a genuinely new one.
• Renaming a file would otherwise orphan its baseline entry, so --update-baseline rewrites the file. It refuses to run when the total would grow, which lets it relocate grandfathered references but not silence new ones.
• The hook excludes scripts/, because the checker and its tests have to spell out the forms they reject.

Deliberately not closing GH-55461: the bulk conform is still open, and whether it is worth doing is the call the issue was asking for. Merging this only fixes the format of new code.

Two things worth a look:

• The separator class is narrow on purpose. Allowing _ would false-positive on identifiers such as gh_13141_expected in test_html.py, and allowing , would match CSV fixture rows like GH,100102040,jkl,0205 in test_dtypes_basic.py. Digits are capped at 2-6 with a trailing lookahead for the same reason.
• Enforcing URL-only going forward leaves the codebase permanently mixed, which arguably makes grepping for a reference worse rather than better - two formats instead of one, where today there are six. Retargeting the hook at a canonical short form instead is a one-constant change, though the baseline would have to be regenerated against the 734 existing URL references.

AI disclosure: drafted with Claude Code (claude opus 5 (high)), which measured the corpus, wrote the checker and its 25 unit tests, and generated the baseline.

[rhshadrach]

Enforcing URL-only going forward leaves the codebase permanently mixed, which arguably makes grepping for a reference worse rather than better

I don't think it makes it worse when compared to the status quo. But maybe that's a bit vacuous because there isn't a way forward that could possibly be worse than status quo 😆.

Of course agreed grepping is slightly worse than going with e.g. GH#1234, but I almost am always just grepping the number bit anyways and I find Ctrl-Click opening in the browser far more valuable. github.com/.*/\d+ is a reliable grep here but agreed it's tedious when compared to what's needed for the alternative.

[rhshadrach]

Suggested change

	yield lineno, match.start(), match.group(0), match.group(1)
	yield lineno, match.start() + 1, match.group(0), match.group(1)

Columns are typically reported as 1-based I believe.