[Actions] CWE-285/ImproperAccessControl.ql Not Currently Working

**Description of the issue**

The Actions ImproperAccessControl query is not working even for trivial workflows. This is an example from https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-285/ImproperAccessControl.md and does not trigger a detection.

```yaml
on:
pull_request_target:
types: [opened, synchronize]

jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Checkout repo for OWNER TEST
uses: actions/checkout@v3
if: contains(github.event.pull_request.labels.*.name, 'safe to test')
with:
ref: ${{ github.event.pull_request.head.sha }}
- run: ./cmd
```

All my attempts to try variations that did trigger a finding also failed. Is this detection enabled as part of the default suite (it appears to be)?

Comece reproduzindo o exemplo de workflow de actions/ql/src/Security/CWE-285/ImproperAccessControl.md e inspecione a consulta ImproperAccessControl.ql correspondente. Verifique se a consulta está incluída no conjunto padrão; a tarefa estará concluída quando for explicado ou corrigido por que o exemplo não produz nenhuma descoberta.

Escrita pelo modelo de indexação a partir do texto da issue.