Tasks are read from the triggering branch when using default_branch provenance on GitLab and Bitbucket Data Center

What happens

Setting pipelinerun_provenance: default_branch tells Pipelines-as-Code to take the pipeline definition from the repository's default branch, so that someone pushing to another branch cannot change what runs.

On GitLab and Bitbucket Data Center only half of that holds. The pipeline definition does come from the default branch, but any task or pipeline it pulls in from a path inside the same repository is read from whichever branch triggered the event.

Someone can leave the pipeline definition alone, edit a task file on their own branch, and have their edited task run.

GitHub, Bitbucket Cloud and Gitea/Forgejo read both from the default branch. Gitea/Forgejo was fixed in #2976.

How to see it

1. Set pipelinerun_provenance: default_branch on a GitLab or Bitbucket Data Center repository.
2. On the default branch, commit a PipelineRun that pulls in a task by path, for example pipelinesascode.tekton.dev/task: "[.tasks/mytask.yaml]".
3. On another branch, commit a different version of .tasks/mytask.yaml and trigger a run on that branch.
4. The task from the second branch runs.

What should happen

Both providers should fall back to the default branch when resolving in-repository paths, the way the other three already do. GitHub and Bitbucket Cloud remember the provenance setting while resolving files, so copying that approach should be enough.

Notes

docs/content/docs/advanced/incoming-webhooks.md currently lists the three providers where tasks come from the default branch. Once this lands, that sentence can drop the provider list and state it generally.

There is a related but separate gap worth handling on its own: provenance follows a branch name rather than a fixed commit, so a push to the default branch while a run is being prepared can leave the pipeline and its tasks on different commits.

Start by tracing how GitLab and Bitbucket Data Center resolve in-repository task and pipeline paths under default_branch provenance, comparing the existing GitHub and Bitbucket Cloud behavior. Update the provider logic and its tests so those paths use the default branch, then revise docs/content/docs/advanced/incoming-webhooks.md to remove the provider list and verify the reproduction no longer runs the triggering branch's task.