pr_runs_on_self_hosted: ARM64 hosted runner labels misdetected as self-hosted

**Describe the bug**

`pr_runs_on_self_hosted` flags GitHub-hosted ARM64 runner labels as self-hosted. The affected labels are:

- `ubuntu-24.04-arm` (GA Aug 2025)
- `ubuntu-22.04-arm` (GA Aug 2025)
- `ubuntu-26.04-arm` (public preview, Jun 2026)
- `windows-11-arm` (GA Aug 2025)
- `windows-11-vs2026-arm` (public preview, Jun 2026)

These are GitHub's own hosted runner images, not self-hosted infrastructure. See [GitHub's runner reference](https://docs.github.com/en/actions/reference/runners/github-hosted-runners) for the authoritative label list.

The detection lives in `job_uses_self_hosted_runner` in [`opa/rego/poutine/utils.rego`](https://github.com/boostsecurityio/poutine/blob/main/opa/rego/poutine/utils.rego), which matches `runs_on` against:

```
(?i)^((ubuntu-(([0-9]{2})\.04|latest(-(4|8|16)-cores)?|slim)|macos-([0-9]{2}|latest)(-x?large)?|windows-(20[0-9]{2}|latest(-8-cores)?)|(buildjet|warp)-[a-z0-9-]+))$
```

No alternative in this pattern accounts for arm64-suffixed labels on either the Linux (`-arm`) or Windows (`11(-vsNNNN)?-arm`) side.

The regex has been modified since arm64 runners entered public preview without arm64 labels being added:

- #293 (May 2025): added `-cores` suffixes for larger runners
- #383 (Jan 2026): added `ubuntu-slim`

#383 landed five months after arm64 reached general availability.

**To Reproduce**

Tested against poutine v1.1.6 (latest release).

Any repo with a workflow triggered on `pull_request` containing:

```yaml
jobs:
build:
runs-on: ubuntu-24.04-arm
```

or

```yaml
jobs:
build:
runs-on: windows-11-arm
```

`poutine analyze_local .` reports `pr_runs_on_self_hosted` for that job.

Concrete example: the `clouatre-labs/aptu-github-app` repo has 21 jobs across 11 workflows using `runs-on: ubuntu-24.04-arm`. All are flagged.

**Expected behavior**

GitHub-hosted arm64 labels should be recognized as hosted runners, not flagged as self-hosted:

- `ubuntu-22.04-arm`, `ubuntu-24.04-arm`, `ubuntu-26.04-arm`
- `windows-11-arm`, `windows-11-vs2026-arm`

**Suggested fix**

Extend the `ubuntu-` and `windows-` alternatives to account for arm64 labels:

```
ubuntu-(([0-9]{2})\.04(-arm)?|latest(-(4|8|16)-cores)?|slim)|macos-([0-9]{2}|latest)(-x?large)?|windows-(20[0-9]{2}|latest(-8-cores)?|11(-vs[0-9]{4})?-arm)|(buildjet|warp)-[a-z0-9-]+
```

Key changes:
- `ubuntu-(([0-9]{2})\.04(-arm)?|...)` -- adds optional `-arm` suffix to versioned Ubuntu labels
- `windows-(...|11(-vs[0-9]{4})?-arm)` -- adds `windows-11-arm` and `windows-11-vs2026-arm` (the `-vsNNNN` segment sits between `11` and `-arm`, matching the label format announced in the [Jun 2026 changelog](https://github.blog/changelog/2026-06-11-new-runner-images-in-public-preview/))

The test suite in `opa/opa_test.go` has no arm64 test cases, and `scanner/testdata/.github/workflows/allowed_pr_runner.yml` has no arm64 runner entries. Both should be updated alongside the regex change.

For reference, [actionlint's `allGitHubHostedRunnerLabels`](https://github.com/rhysd/actionlint/blob/main/rule_runner_label.go) maintains an exhaustive list of GitHub-hosted runner labels and could serve as a cross-reference.

**Workaround**

`rulesConfig.pr_runs_on_self_hosted.allowed_runners` or a repo-wide `skip: - rule: pr_runs_on_self_hosted` in `.poutine.yml`. Mentioned as context, not as a substitute for fixing the detection.