✨ Detect more untrusted context patterns in Dangerous-Workflow check

[darkknight8670]

What kind of change does this PR introduce?

Improvement to the Dangerous-Workflow check (script injection detection).

Fixes #3915

What is the current behavior?

containsUntrustedContextPattern in checks/raw/dangerous_workflow.go misses
several attacker-controlled GitHub event context fields, so workflows
interpolating them into run: scripts are not flagged as script-injection
risks. Examples not detected:

• github.event.fork.forkee.name (and other forkee fields)
• github.event.workflow_run.head_branch

What is the new behavior?

The untrusted-input pattern now also detects the following fields, which are
attacker-controlled per GitHub's webhook events and payloads docs
and the GitHub Security Lab untrusted-input research:

fork event — anyone can fork a repo and controls the fork's metadata:

• fork.forkee.name
• fork.forkee.full_name
• fork.forkee.description
• fork.forkee.homepage
• fork.forkee.default_branch

workflow_run event — attacker controls these via the triggering PR/branch:

• workflow_run.head_branch
• workflow_run.display_title
• workflow_run.head_repository.description
• workflow_run.pull_requests[*].head.ref

Note: issue_comment.comment.body and commit_comment.comment.body mentioned
in #3915 were already detected by the existing comment\.body pattern — this PR
adds regression tests to cover them explicitly.

Unit tests added for all new patterns, including negative cases
(fork.forkee.id, workflow_run.id) to guard against over-matching.

Which issue(s) this PR fixes

Fixes #3915

Special notes for your reviewer

The field list was derived from GitHub's webhook payload documentation; happy
to add further fields (e.g. other free-text fields from less common events) if
reviewers think the coverage should be broader.

Does this PR introduce a user-facing change?

Dangerous-Workflow: detect additional untrusted context patterns (fork.forkee.*, workflow_run.head_branch/display_title/pull_requests head refs) in script injection detection

[darkknight8670]

Hi maintainers! This PR expands the Dangerous-Workflow check by detecting additional untrusted context patterns that were previously missed and includes tests for the new cases. I'd appreciate a review when you have time. Thanks!

[github-actions]

This pull request has been marked stale because it has been open for 10 days with no activity

[darkknight8670]

Hi maintainers! This PR is still ready for review. It adds additional untrusted context patterns to the Dangerous-Workflow check along with tests. I'd appreciate a review when someone has time. Thanks!