[Actions] CWE-285/ImproperAccessControl.ql Not Currently Working

**Description of the issue**

The Actions ImproperAccessControl query is not working even for trivial workflows. This is an example from https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-285/ImproperAccessControl.md and does not trigger a detection.

```yaml
on:
pull_request_target:
types: [opened, synchronize]

jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Checkout repo for OWNER TEST
uses: actions/checkout@v3
if: contains(github.event.pull_request.labels.*.name, 'safe to test')
with:
ref: ${{ github.event.pull_request.head.sha }}
- run: ./cmd
```

All my attempts to try variations that did trigger a finding also failed. Is this detection enabled as part of the default suite (it appears to be)?

Start by reproducing the workflow example from actions/ql/src/Security/CWE-285/ImproperAccessControl.md and inspect the corresponding ImproperAccessControl.ql query. Check whether the query is included in the default suite; done means explaining or correcting why the example produces no finding.

Written by the indexing model from the issue text.