Allow the target hostname(s) to be set when triggering the GHA manually

[stevejalim]

The workflow_dispatch trigger for the Site Scanning action currenlty just asks for the branch to draw the action from. We could extend this to accept a particular hostname (or several, to cover origin server(s) and CDN) rather than the defaults (which are drawn from Secrets. This would let us run entire-site checks against Dev or Staging.

Points to consider

• We currently keep the hostnames of origins somewhat secret and exclude them from logs - can we do that with manaual params?
• Would we want a PR with changes to the allowlist to be generated for a non-prod domain? Could we make it toggleable
• Same as above, but for creating new Issues for things that aren't just automatically updating the allowlist