Run CI checks first as part of CD workflow

[lorenyu]

The CD App workflow right now deploys to dev environment on merges to main, and separately the CI App workflows (e.g. flask template ci-app and nextjs template ci-app also run on merges to main). This ticket is to have the deploys only continue if the CI checks pass.

This ticket has some complexity since it crosses the boundaries between templates. We need to do at least the following:

• Update the ci-app workflows in the Nextjs and Flask templates to get rid of the push to main trigger and to instead include a workflow_call trigger so it can be triggered by cd-app
• Update the cd-app.yml workflow in Infra template to call the ci-app workflow (it won't exist in template-infra but that's ok since this workflow doesn't actually get called directly in template-infra)
• Update application-requirements.md to add a requirement that the application has a ci-<APP_NAME>.yml workflow

credit to @daphnegold for the suggestion