[actions] Add detection for workflow_dispatch TOCTOU

**Description of the issue**

There is a newer variation of GitHub Actions TOCTOU vulnerabilities known as "Workflow dispatch TOCTOU" - I wrote about a real-world example in a recent bug report writeup:

https://adnanthekhan.com/posts/dependabot-core-toctou-writeup/

I think this is a good candidate for a `High` detection where a PR has the following characteristics:

* Runs on workflow dispatch / repository dispatch with the PR number as an input parameter. Does NOT require a commit SHA.
* Checks out code from that PR without some approval check.
* Runs code.

High because there is a lot of context required to understand if a maintainer would _actually_ ever run the workflow on a fork, and that is not possible to determine via static analysis alone.

I believe this would require some code changes in the library code - adding a concept of a non externally triggered workflow that is intended to act upon untrusted code. This could then fire the UntrustedCheckoutTOCTOU alert

Start by reviewing the issue's workflow_dispatch and repository_dispatch scenarios and the existing UntrustedCheckoutTOCTOU alert in the library code. Determine how to represent workflows acting on untrusted code without an approval check, then verify that matching workflows are detected while workflows requiring a commit SHA are not.

Rédigé par le modèle d'indexation à partir du texte de l'issue.