[actions] Add detection for workflow_dispatch TOCTOU

**Description of the issue**

There is a newer variation of GitHub Actions TOCTOU vulnerabilities known as "Workflow dispatch TOCTOU" - I wrote about a real-world example in a recent bug report writeup:

https://adnanthekhan.com/posts/dependabot-core-toctou-writeup/

I think this is a good candidate for a `High` detection where a PR has the following characteristics:

* Runs on workflow dispatch / repository dispatch with the PR number as an input parameter. Does NOT require a commit SHA.
* Checks out code from that PR without some approval check.
* Runs code.

High because there is a lot of context required to understand if a maintainer would _actually_ ever run the workflow on a fork, and that is not possible to determine via static analysis alone.

I believe this would require some code changes in the library code - adding a concept of a non externally triggered workflow that is intended to act upon untrusted code. This could then fire the UntrustedCheckoutTOCTOU alert

先檢視 issue 的 workflow_dispatch 和 repository_dispatch 情境，以及程式庫程式碼中現有的 UntrustedCheckoutTOCTOU 警示。確定如何表示在沒有核准檢查的情況下對不受信任程式碼執行操作的工作流程，然後驗證能偵測到符合條件的工作流程，而要求 commit SHA 的工作流程不會被偵測到。

由索引模型根據 Issue 內容生成。