✨ Analyze Makefile recipes for unpinned downloads

[basriakkaya]

What kind of change does this PR introduce?

Feature: extend the Dependency-Pinning check to analyze Makefile recipe commands.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

The check analyzes shell scripts, workflow run blocks, and Dockerfile RUN commands, but it does not detect unpinned download-and-execute patterns in Makefile recipes.

What is the new behavior (if this is a feature change)?

Makefile recipe commands are passed through the existing shell download validator. The implementation:

• recognizes conventional Makefile names case-insensitively

• ignores non-recipe syntax and recipe comments

• handles Make command prefixes (@, -, and +)

• joins backslash-continued recipe commands

• preserves source line locations

• tracks downloaded files across recipes in the same Makefile

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #884

Special notes for your reviewer

Validation completed:

• go test ./checks/... -count=1
• tools/bin/golangci-lint run -c .golangci.yml --new-from-rev=HEAD (0 issues)
• git diff --check

The repository-wide make check-linter currently also reports two pre-existing findings outside this change in policy/policy.go:144 (cognitive complexity) and policy/policy_test.go:311 (field alignment).

Does this PR introduce a user-facing change?

Dependency-Pinning now detects unpinned download-and-execute commands in Makefile recipes.