Fix case-insensitive classification label allowlist filtering

Fixes #1077.

## Summary
This updates the pre-sanitization logic for `add_labels` operations to match configured `classification-labels` case-insensitively, so valid labels are not dropped when casing differs between workflow input and agent output.

## Changes
1. Updated shared fragment: `.github/workflows/gh-aw-fragments/safe-output-add-labels.md`
- Builds a normalized allowlist (`toLowerCase`) and compares labels using case-insensitive matching.
- Updated the documented allowlist behavior to explicitly call out case-insensitive matching.
2. Applied the same generated updates in:
- `.github/workflows/gh-aw-issue-triage.lock.yml`
- `.github/workflows/gh-aw-dependency-review.lock.yml`

## Why this resolves the bug
When `classification-labels` contains values like `Bug, Triage` and agent output uses `bug, triage`, labels now pass sanitization instead of being removed.

## Validation
- `make lint`
- Reproduction check equivalent to the issue scenario now retains labels with case differences.
- Repository test suite passed in a local venv with required dependencies installed (`pytest`, `pyyaml`, `mkdocs`, `mkdocs-material`).

> [!WARNING]
>
> ⚠️ Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `astral.sh`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "astral.sh"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Bug Hunter](https://github.com/elastic/ai-github-actions/actions/runs/25433036364)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/elastic/ai-github-actions/actions/runs/25433036364)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 25433036364 -n agent -D /tmp/agent-25433036364

# Fetch the bundle into a local branch
git fetch /tmp/agent-25433036364/aw-fix-1077-case-insensitive-label-allowlist.bundle refs/heads/fix-1077-case-insensitive-label-allowlist:refs/heads/fix-1077-case-insensitive-label-allowlist-6a7d1265df8cfec0
git checkout fix-1077-case-insensitive-label-allowlist-6a7d1265df8cfec0

# Push the branch to origin
git push origin fix-1077-case-insensitive-label-allowlist-6a7d1265df8cfec0

# Create the pull request
gh pr create --title 'Fix case-insensitive classification label allowlist filtering' --base main --head fix-1077-case-insensitive-label-allowlist-6a7d1265df8cfec0 --repo elastic/ai-github-actions
```