Update untrusted_checkout_exec to respect actions/checkout new behavior

[Talgarr]

Reimplement this #442

Summary

Update untrusted_checkout_exec to account for the new fork pull request protection in supported actions/checkout releases.

Poutine now suppresses findings when actions/checkout itself blocks untrusted fork code from being checked out. This reduces false positives without suppressing workflows that opt out of the protection or remain exposed through other events.

Background

GitHub introduced safer defaults for actions/checkout on pull_request_target and pull-request-originated workflow_run events:

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/

Supported releases now refuse to check out fork pull request code unless allow-unsafe-pr-checkout: true is explicitly configured.

Behavior

A finding is suppressed when all of the following apply:

• The checkout release contains the fork PR guard.
• The checkout targets pull request code.
• The workflow uses a guarded event.
• allow-unsafe-pr-checkout is not enabled or dynamically configured.
• A workflow_run trigger only references pull-request workflows.
• No additional event handled by the rule bypasses the checkout guard.

Findings remain for:

• actions/checkout@v1
• Semantic versions below their release line's fixed version
• Known vulnerable commit SHAs
• allow-unsafe-pr-checkout: true
• Dynamic allow-unsafe-pr-checkout values
• Mixed or otherwise unguarded events
• workflow_run triggers with non-PR upstream workflows

Exact commit references are classified using a frozen set derived from the official actions/checkout commit graph. The dataset records its provenance, guard-introduction commits, entry count, and checksum.