feat(cli): complete actions audit workflow scanner with secrets-in-run and third-party-action rules

[Copilot]

sh1pt build actions audit was missing two of the eight security rules called out in the issue. This PR fills the gaps so the scanner covers all requested patterns.

New audit rules

Rule	Severity	Pattern detected
secrets-in-run	high	${{ secrets.* }} interpolated directly in a run: step — leaks plaintext into workflow logs
third-party-action	low	uses: from outside trusted orgs (actions/, github/, aws-actions/, azure/, docker/, hashicorp/, google-github-actions/, slsa-framework/) not pinned to a 40-char SHA digest

Full rule coverage after this PR

Rule	Severity
unpinned-action-branch	high
write-all-permissions	high
pull-request-target	high
curl-pipe-bash / wget-pipe-bash	high
secrets-in-run ✨	high
missing-permissions	medium
unpinned-docker-image	medium
third-party-action ✨	low

Example

$ sh1pt build actions audit --repo . --json
{
  "repoDir": "/my/repo",
  "filesScanned": 3,
  "findings": [
    { "file": "...", "rule": "secrets-in-run", "severity": "high",
      "message": "secret interpolated directly in a `run:` step — value may appear in workflow logs" },
    { "file": "...", "rule": "third-party-action", "severity": "low",
      "message": "action some-org/cool-action is from a third-party publisher — consider pinning to a SHA digest" }
  ],
  "riskLevel": "high"
}

Implementation notes

• secrets-in-run regex handles both inline (- run: cmd ${{ secrets.X }}) and YAML block-scalar forms (- run: |\n cmd ${{ secrets.X }})
• third-party-action deduplicates findings per action ref (same action used in multiple jobs only reported once)
• Block scalar regex tightened to [|>][-+]?\d* to match only valid YAML chomping/indentation indicators

[alwaysmeticulous]

Meticulous was unable to execute a test run for this PR because the most recent commit is associated with multiple PRs. To execute a test run, please try pushing up a new commit that is only associated with this PR.

_{Last updated for commit f53ffb3. This comment will update as new commits are pushed.}

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.