fix: support Windows in fetch secrets action

[Hweinstock]

Summary

• replace Bash-backed composite steps with Node execution
• preserve role masking, environment-variable-to-secret mappings, error handling, and GitHub output formatting

Spec

Make .github/actions/fetch-secrets/action.yml Windows-compatible by using a Node.js script without changing functionality. Run the script in isolation and verify it against the required AWS account.

Verification

• node --check .github/actions/fetch-secrets/build-secret-mappings.js
• parsed the action YAML file
• git diff --check
• ran build-secret-mappings.js directly with one shared and one repository-specific secret
• confirmed the active AWS account and validated both generated secret names with metadata-only Secrets Manager calls; no secret values were read or printed
• the prior hosted Windows validation passed in 17 seconds before the temporary test workflow was removed

Reproduction

1. Set SHARED_NAMES, REPO_NAMES, CALLER_REPO, and GITHUB_OUTPUT.
2. Run node .github/actions/fetch-secrets/build-secret-mappings.js.
3. Inspect GITHUB_OUTPUT for the environment-variable-to-secret mappings.