Flag issue_comment as a dangerous trigger

[dguido]

Pre-submission checks

• This PR corresponds to an issue (if not, please create one first).
• I hereby disclose the use of an LLM or other AI coding assistant in the creation of this PR.

Summary

• Adds issue_comment to the dangerous-triggers audit at Medium severity / Medium confidence (Regular persona), acknowledging it has more legitimate uses than pull_request_target or workflow_run while still flagging the security risk
• Adds has_issue_comment() method to the Workflow model following existing has_pull_request_target() / has_workflow_run() pattern
• Enables and populates the previously-stubbed dangerous_triggers integration test module with tests for all three trigger types

Closes #1606

Test Plan

• issue_comment flagged as bare event (on: issue_comment)
• issue_comment flagged with event body (on: issue_comment: types: [created])
• pull_request_target still flagged at High severity
• workflow_run still flagged at High severity
• Multiple dangerous triggers in one workflow all reported
• Safe triggers (push) produce no findings
• Existing template_injection/issue-418-repro snapshot updated (uses issue_comment)
• Full integration suite passes (204/204)

[woodruffw]

I'm vaguely worried this is going to be too noisy/disruptive, given how common issue_comment is. I'm not inherently opposed to it, but I think I'd like to add more "crater" tests to understand the impact before merging this.

(An alternative would be to push ahead with an approach like #935.)

[dguido]

Thanks for the review. Pushed a new iteration that addresses code quality issues and should also help with the noise concern:

• Trait contract fix: Removed the audit_normal_job override and inlined the issue_comment job-level check into audit_workflow. The previous implementation overrode both methods with audit_workflow manually re-dispatching to audit_normal_job, which goes against the trait docs.

• Trusted-role validation: has_author_association_guard now validates that author_association is compared against a trusted role (OWNER, MEMBER, COLLABORATOR), not just that the context is referenced anywhere in the expression. Previously, a guard like if: github.event.comment.author_association == 'CONTRIBUTOR' would suppress the finding even though CONTRIBUTOR doesn't restrict execution to trusted actors. This should reduce false negatives without adding noise—it only changes behavior for workflows with weak guards.

• Duplicate fixture removed: issue-comment-no-guard.yml was byte-identical to issue-comment-bare.yml (same code path), so it's been replaced with issue-comment-weak-guard.yml which tests the new trusted-role validation (CONTRIBUTOR guard correctly produces a finding).

Agreed that crater testing before merge makes sense—happy to wait on that. The trusted-role validation in this iteration should make the audit more precise, which may help with the noise concern.