[actions] Add detection for workflow_dispatch TOCTOU

**Description of the issue**

There is a newer variation of GitHub Actions TOCTOU vulnerabilities known as "Workflow dispatch TOCTOU" - I wrote about a real-world example in a recent bug report writeup:

https://adnanthekhan.com/posts/dependabot-core-toctou-writeup/

I think this is a good candidate for a `High` detection where a PR has the following characteristics:

* Runs on workflow dispatch / repository dispatch with the PR number as an input parameter. Does NOT require a commit SHA.
* Checks out code from that PR without some approval check.
* Runs code.

High because there is a lot of context required to understand if a maintainer would _actually_ ever run the workflow on a fork, and that is not possible to determine via static analysis alone.

I believe this would require some code changes in the library code - adding a concept of a non externally triggered workflow that is intended to act upon untrusted code. This could then fire the UntrustedCheckoutTOCTOU alert

まず、issue の workflow_dispatch および repository_dispatch シナリオと、ライブラリコードに既存する UntrustedCheckoutTOCTOU アラートを確認します。承認チェックなしで信頼できないコードに対して動作するワークフローをどのように表現するかを決定し、そのうえで、一致するワークフローが検出され、commit SHA を必要とするワークフローは検出されないことを検証します。

索引モデルが issue の本文から書いたものです。