PR build cannot detect Dangerous-Workflow / untrusted-checkout patterns before merge

## Summary

The critical Scorecard *Dangerous-Workflow* alert [#337](https://github.com/microsoft/hve-core/security/code-scanning/337) (untrusted code checkout in `vex-draft.lock.yml`) was only discovered **after** PR [#2038](https://github.com/microsoft/hve-core/pull/2038) merged to `main`. The PR build had no capability to catch it. This issue tracks closing that coverage gap.

## Root cause: two independent gaps

1. **Scorecard never runs on pull requests.** [.github/workflows/scorecard.yml](https://github.com/microsoft/hve-core/blob/main/.github/workflows/scorecard.yml) triggers only on `schedule`, `push: [main]`, `workflow_run` (post-release), and `workflow_dispatch`. Its Dangerous-Workflow analyzer therefore only evaluates the default branch after merge, so it cannot gate a PR.

2. **The PR-build workflow security scripts don't model dangerous patterns.** [scripts/security/Test-WorkflowPermissions.ps1](https://github.com/microsoft/hve-core/blob/main/scripts/security/Test-WorkflowPermissions.ps1) only checks for the presence of a top-level `permissions:` block. The other security scripts (SHA pinning, action-version consistency, dependency pinning, SHA staleness) only validate action pinning. None inspect trigger context or checkout `ref` provenance, so a privileged `workflow_run` job checking out an agent-derived `ref` passes every existing check.

## Proposed work

Close the gap on either (or both) axes:

- [ ] Add a PR-scoped dangerous-workflow gate — e.g. a `pull_request`-triggered `zizmor` (or Scorecard) step that fails the PR build on untrusted-checkout / dangerous-workflow patterns.
- [ ] Extend the workflow security PowerShell suite with a check that flags jobs under privileged triggers (`workflow_run`, `pull_request_target`) whose `checkout` `ref` resolves from step outputs or event head refs, with Pester coverage.

## Acceptance criteria

- [ ] A PR introducing an untrusted-checkout dangerous-workflow pattern fails a required PR-build check before merge.
- [ ] The new check has test coverage and is wired into the appropriate `npm run` lint/validation entry point.

## Context

Follow-up from #2311 / PR #2312, which fixed the specific `vex-draft` instance of alert #337 by pinning `create-pull-request.base-branch: main`.