New audit: comment triggers

[woodruffw]

A lot of workflows use the issue_comment trigger, followed by a match on the comment body like so:

if: github.event.issue.pull_request && contains(github.event.comment.body, '/execute')

When a user comments /execute, the workflow then performs whatever action matches the command.

This has two footguns:

• Without an appropriate actor/actor association check, this allows anybody on GitHub to trigger the workflow. Typically this is just a waste of CI minutes, but sometimes it can also trigger something destructive.
• More generally, issue_comment is a "privileged" trigger like pull_request_target and workflow_run, meaning that it has access to the default GITHUB_TOKEN. This makes it an appealing entrypoint for cache poisoning, etc.

This will probably be an auditor-only check, since it's hard to establish a security baseline for these.