Use the pull request base ref for public symbols checks

[saisharan0103]

The public symbols checker currently diffs against main: the workflow prepares a local main branch before checking out the PR head, and scripts/public_symbols_checker.py calls repo.commit("main") directly.

For release-branch pull requests, especially patch release PRs, that compares API changes against the default branch instead of the release branch base. This can produce false public API failures that require the approval-label workaround.

This updates scripts/public_symbols_checker.py to resolve the comparison ref from GITHUB_BASE_REF when running in pull request CI. It prefers origin/<base> when available, falls back to the local branch name, and keeps main as the fallback for local or non-PR runs. The existing diff logic now uses that resolved commit instead of repo.commit("main").

Generated workflow files are unchanged. The contrib reusable workflow branch pin remains a separate documented limitation because GitHub Actions uses: cannot be parameterized.

Fixes #5139.

ruff check scripts/public_symbols_checker.py reports no new findings on the changed files.

[linux-foundation-easycla]

• ❌ The email address for the commit (32d37a8) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.