Add backport apply command

[tianyiy-tim]

Issues:

Addresses P425131803

Description of changes:

analyze only reports which branches are affected. Acting on that still means cherry-picking the fix onto each branch by hand, which for a fix that hits seven branches is seven rounds of the same work.

This pull request adds apply, which cherry-picks the fix onto one local branch per affected branch, named backport-<release branch>-<fix>.

Stacked on #3389. The base here is backport-stack/analyze, a scaffolding branch holding that PR's commits, so this diff is only the 7 files this change touches. I will retarget it to main once #3389 merges. Please don't merge it into the scaffolding branch.

Call-outs:

• Each pick runs in its own worktree, so the branch you have checked out never moves and a half-finished cherry-pick can't strand your working tree mid-merge.

• A clean pick leaves the branch and removes its worktree. A conflict keeps the worktree, stopped mid-cherry-pick, so you can fix it in place.

• Branches that analyze could not settle are left out. Cherry-picking onto one of those would be a guess.

• Cherry-picks pass -x so the commit carries the "cherry picked from commit" line. That's one of the three signals analyze uses to spot a branch that already has the fix, so without it the tool couldn't recognise its own backports on a later run.

• Each branch is cut from the same remote-tracking release branch analyze judged, not from origin. Locally origin is usually a fork that is behind on the release branches, and a backport built on a base the analysis never saw can cherry-pick cleanly and still be the wrong change.

• Nothing is pushed and no pull request is opened. That's the next one.

Testing:

Unit tests - 19 new, 141 total:

python3 -m unittest testing.test_engine

They cover the branch naming, which branches get picked, the run file it reads, that the worktree starts from the ref analyze judged rather than origin, and that a clean pick removes its worktree while a conflict keeps it.

Real fix - ran apply for ac3aee310 across all 7 release branches: 2 applied cleanly and 5 conflicted. Confirmed the conflicted worktrees were left mid-cherry-pick with UU markers, the clean picks produced commits on top of the release branch with the original subject kept, and the -x trailer is written and found by branch_mentions_cherry_pick.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[nhatnghiho]

Good job with this PR! Few minor comments below

[nhatnghiho]

It isn't very clear to me why we need --yes? Can you elaborate more in the help message why test scripts need it?

[nhatnghiho]

nit: add a section in your README explaining the structure of the runstate files in .backport-runs/