🐛 Detect additional untrusted workflow contexts

[dhrrishitvdeka]

What kind of change does this PR introduce?

Patch fix for the Dangerous-Workflow check's script-injection detection.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

containsUntrustedContextPattern does not recognize several attacker-controlled event fields that GitHub's current CodeQL Actions model treats as untrusted. Workflows can therefore interpolate these values directly into run: scripts without Scorecard reporting the script-injection risk.

The uncovered fields include previous title, body, and head-ref values from edited events; merge-group refs and committer metadata; wiki-page titles; and workflow paths.

What is the new behavior (if this is a feature change)?

Dangerous-Workflow now detects:

• github.event.pages[*].title
• github.event.changes.title.from
• github.event.changes.body.from
• github.event.changes.head.ref.from
• github.event.merge_group.head_ref
• github.event.merge_group.committer.name
• github.event.merge_group.committer.email
• github.event.workflow.path
• github.event.workflow_run.path
• github.event.workflow_run.referenced_workflows[*].path

Table-driven tests cover every new pattern and nearby trusted fields to guard against over-matching.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Towards #3915.

Special notes for your reviewer

The field list is derived from GitHub CodeQL's current untrusted event properties model. This scope intentionally excludes committer fields already proposed in #4968 and fork/workflow-run fields already proposed in #5127.

Validation:

• go test ./checks/raw -run TestUntrustedContextVariables -count=1 passes with Go 1.25.6.
• git diff --check passes.
• The full checks/raw package was attempted on Windows, but unrelated existing tests assume /tmp paths and panic in TestCollectGitHubActionsWorkflowPinning; Linux CI can exercise the full package.

Does this PR introduce a user-facing change?

Repositories that interpolate these attacker-controlled fields directly into inline scripts will now be reported by Dangerous-Workflow.

Dangerous-Workflow: detect additional untrusted edited-event values, merge-group metadata, wiki titles, and workflow paths.