[Actions] CWE-285/ImproperAccessControl.ql Not Currently Working

**Description of the issue**

The Actions ImproperAccessControl query is not working even for trivial workflows. This is an example from https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-285/ImproperAccessControl.md and does not trigger a detection.

```yaml
on:
pull_request_target:
types: [opened, synchronize]

jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Checkout repo for OWNER TEST
uses: actions/checkout@v3
if: contains(github.event.pull_request.labels.*.name, 'safe to test')
with:
ref: ${{ github.event.pull_request.head.sha }}
- run: ./cmd
```

All my attempts to try variations that did trigger a finding also failed. Is this detection enabled as part of the default suite (it appears to be)?

まず actions/ql/src/Security/CWE-285/ImproperAccessControl.md のワークフロー例を再現し、対応する ImproperAccessControl.ql クエリを調べます。そのクエリがデフォルトスイートに含まれているか確認します。完了条件は、例で検出結果が生成されない理由を説明または修正することです。

索引モデルが issue の本文から書いたものです。