Feature: overprovisioned-secrets should also consider dynamic accesses

[woodruffw]

Pre-submission checks

• I am not reporting a bug (crash, false positive/negative, etc). These must be filed via the bug report template.
• I have looked through the open issues for a duplicate request.

What's the problem this feature will solve?

Right now, overprovisioned-secrets detects patterns like toJSON(secrets).

However, another case that should be caught that results in overprovisioning is when secrets is indexed via a key that isn't known until workflow execution time, e.g.:

GH_TOKEN: ${{ secrets[format('GH_PAT_%s', matrix.env)] }}

poutine's job_all_secrets check has additional details: https://github.com/boostsecurityio/poutine/blob/main/docs/content/en/rules/job_all_secrets.md

Describe the solution you'd like

See above.

Additional context

No response