feat(rules): add <flag:name> placeholder to inspect every value of repeated and aliased flags in when clauses

[fohte]

Why

• when clauses cannot inspect every value of a repeated or aliased flag
  • gh api graphql -f query=mutation{...} -f variables={} should expose all -f values to detect mutations
  • curl -d @/etc/passwd -d "innocent=data" should fire when even one value sends a sensitive file
  • docker run -v /etc/shadow:/leak:ro -v ./app:/app should expose every --volume mount, not just the last one
• The existing flags map is last-wins: when the same flag appears multiple times, only one value survives
• Aliased flags such as -f and --field land under separate keys (flags.f vs flags["field"]), so a when clause cannot check them as a single set

What

• Add definitions.flag_groups to declare named groups of aliased flags
• Add a <flag:name> placeholder that matches any flag in a named group
• Expose every captured value through a new flag_groups[name] CEL variable, always as a list

definitions:
  flag_groups:
    field-flag: ['-f', '-F', '--field', '--raw-field']

rules:
  # Ask whenever any -f / -F / --field / --raw-field value is a mutation
  - allow: 'gh api graphql <flag:field-flag> *'
    when: '!flag_groups["field-flag"].exists(v, v.startsWith("query=mutation"))'
  - ask: 'gh api graphql <flag:field-flag> *'

• flag_groups[name] is always a list, even when only one value matches, so CEL macros (exists, all, size) work uniformly
• Every group declared in definitions.flag_groups is seeded as an empty list [] even when the matched rule did not capture any value, so flag_groups["name"] never raises an undeclared-reference error
• Referencing an undefined group through <flag:undefined> is rejected at config load time as a validation error
• The existing flags map and <var:name> / <path:name> placeholders are unchanged (additive, non-breaking)

---

[codecov]

Codecov Report

❌ Patch coverage is 91.93548% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.55%. Comparing base (fd61be6) to head (20adad4).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
src/rules/pattern_matcher/mod.rs	89.59%	18 Missing ⚠️
src/rules/pattern_parser.rs	91.22%	5 Missing ⚠️
src/config/model.rs	98.00%	1 Missing ⚠️
src/rules/rule_engine.rs	96.15%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #278      +/-   ##
==========================================
+ Coverage   89.50%   89.55%   +0.04%     
==========================================
  Files          52       52              
  Lines       10731    11010     +279     
==========================================
+ Hits         9605     9860     +255     
- Misses       1126     1150      +24     

Flag	Coverage Δ
Linux	89.35% <91.93%> (+0.08%)	⬆️
macOS	90.86% <91.93%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.