Changes

ci(tipipeline): migrate checkoutRefs callsites to new signature (#4286)

## Summary
- align `prow.checkoutRefs` callsites with the updated
`checkoutRefs(refs, credentialsId, timeout, gitBaseUrl, withSubmodule)`
signature
- migrate all `prow.checkoutPrivateRefs(...)` pipeline callsites to
`prow.checkoutRefs(...)`
- update `libraries/tipipeline/vars/prow.groovy` internal wrapper calls
to match the new argument order
- normalize host handling in `checkoutPrivateRefs` (`ssh-keyscan` uses
parsed host when URL is passed)

## Validation
- Jenkinsfile validation for changed pipelines: `pass=125 fail=0
total=125`
- `git diff --check` passed

## Notes
- no residual risky call pattern remains where `prow.checkoutRefs` takes
`timeout` as the 2nd argument


Ref #4281
 (commit: 666269b)