Changes

refactor(prow): extract _checkoutRefsImpl to deduplicate checkout logic (#4284)

`checkoutRefs` and `checkoutPrivateRefs` contained an identical ~80-line
bash block (git init → fetch → checkout → merge → submodule → gc),
differing only in remote URL scheme and SSH agent setup.

## Changes

- **New `_checkoutRefsImpl(refs, remoteUrl, timeout, withSubmodule)`** —
single canonical implementation of the shared bash checkout pipeline;
called by both public functions.
- **`checkoutRefs`** — computes HTTPS remote URL
(`${gitBaseUrl}/${org}/${repo}.git`) and delegates to
`_checkoutRefsImpl`. Signature unchanged.
- **`checkoutPrivateRefs`** — computes SSH remote URL
(`git@${gitSshHost}:${org}/${repo}.git`), retains its `sshagent` wrap
and `ssh-keyscan` step, then delegates to `_checkoutRefsImpl`. Signature
unchanged.

```groovy
def checkoutRefs(refs, timeout = 5, credentialsId = '', gitBaseUrl = 'https://github.com', withSubmodule = false) {
    final remoteUrl = "${gitBaseUrl}/${refs.org}/${refs.repo}.git"
    _checkoutRefsImpl(refs, remoteUrl, timeout, withSubmodule)
}

def checkoutPrivateRefs(refs, credentialsId, timeout = 5, gitSshHost = 'github.com', withSubmodule = false) {
    final remoteUrl = "git@${gitSshHost}:${refs.org}/${refs.repo}.git"
    sshagent(credentials: [credentialsId]) {
        sh label: 'Know hosts', script: "..."
        _checkoutRefsImpl(refs, remoteUrl, timeout, withSubmodule)
    }
}
```

No behavioral changes — pure deduplication (~94 lines removed).

<!-- START COPILOT ORIGINAL PROMPT -->



<details>

<summary>Original prompt</summary>

> 请在仓库 `PingCAP-QE/ci` 中对 `libraries/tipipeline/vars/prow.groovy`
做一次重构并提交 PR：
> 
> 目标：
> - 保持 `checkoutRefs` 与 `checkoutPrivateRefs`
**两个函数的签名完全不变**（参数列表、默认值都不改），以避免调用方需要修改。
> - 将两者内部高度重复的 bash checkout/merge/submodule/gc 逻辑抽取为一个内部实现函数（例如
`_checkoutRefsImpl` 或等价命名），使两者仅在下列差异处保留各自逻辑：
>   1) remote URL 形式：
> - `checkoutRefs` 使用 HTTPS：`${gitBaseUrl}/${refs.org}/${refs.repo}.git`
> - `checkoutPrivateRefs` 使用
SSH：`git@${gitSshHost}:${refs.org}/${refs.repo}.git`
> 2) private checkout 仍需保留 `sshagent(credentials: [credentialsId]) { ...
}` 以及 `ssh-keyscan` 写入 `~/.ssh/known_hosts` 的步骤。
> - 保持原有行为一致（fetch refspec、checkout base_sha、merge pulls SHAs、清理旧 PR
refs、防止缓存 `.git` 膨胀的 maintenance、可选 submodule 更新等），只做抽取和去重。
> 
> 实现约束/注意：
> - 不做全局引用搜索，不调整其它文件。
> - 确保 groovy 语法在 Jenkins shared library 环境下可用。
> - 如需要增加新 helper 函数，请以当前文件内 `def` 方式实现。
> - 最终打开一个 PR。
> 
> 涉及文件：
> - `libraries/tipipeline/vars/prow.groovy`
> 
> 上下文片段（来自讨论线程，仅供参考，不是文件内容）：
> ```groovy
>         _checkoutRefsImpl(refs, remoteUrl, timeout, withSubmodule)
> ```
> 


</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: wuhuizuo <2574558+wuhuizuo@users.noreply.github.com>
 (commit: e658c11)