gateway: fine-grained trust levels

It would be great if we had a way to define more fine-grained trust levels for GitHub actions: for example, it might be fine to allow many 'questionable' actions in `pull_request` workflows, since those don't have many permissions in the first place. For `push` actions or actions that have access to secrets or write access to caches we might want to be more strict.

I suspect GitHub won't have any provision for this, and I don't see such a concept in other tools such as https://otterdog.readthedocs.io/ and https://docs.zizmor.sh/ .

Filed https://github.com/zizmorcore/zizmor/issues/1271 for this idea at zizmor.

No repository files, tests, or entry points are identified. Start by reviewing the linked zizmor issue and the existing gateway behavior; done would require an agreed design for differentiated trust levels based on workflow context, permissions, secrets, and cache access.

Written by the indexing model from the issue text.