[buildifier] false positive on canonical-repository linter

`canonical-repository` is flagging a false positive, strings with string substitutions containing `@@` as causing a flag.

Extract of code causing the flag:

```
...
ctx.actions.expand_template(
template = ctx.file._runner,
output = out_file,
substitutions = {
"@@GOFMT_BIN@@": shell.quote(gofmt_path),
"@@GOROOT@@": shell.quote(sdk.root_file.dirname),
},
is_executable = True,
)
transitive_depsets = [
depset([sdk.go]),
]
...
```

Buildifier output on master:

```
$ buildifier -lint warn -r .
tools/linters/golang/defs.bzl:22: canonical-repository: String contains "@@" which indicates a canonical repository name reference that should be avoided. (https://github.com/bazelbuild/buildtools/blob/main/WARNINGS.md#canonical-repository)
tools/linters/golang/defs.bzl:23: canonical-repository: String contains "@@" which indicates a canonical repository name reference that should be avoided. (https://github.com/bazelbuild/buildtools/blob/main/WARNINGS.md#canonical-repository)
```

Buildifier output on `v8.2.1`

```
$ buildifier -lint warn -r .
```

Reproduce the report with buildifier -lint warn -r . and inspect tools/linters/golang/defs.bzl around lines 22–23. Determine how the canonical-repository linter handles strings containing @@; done means these substitution strings no longer produce false positives while genuine canonical repository references remain warned.

Written by the indexing model from the issue text.