self-hosted-runner: detect non-GH runners that don't use self-hosted

[woodruffw]

The current audit assumes that self-hosted is a reliable sentinel for whether a job runs on a self-hosted runner or not, but that turns out to not be the case: self-hosted runners can seemingly use any labels, assuming the underlying runner controller/orchestrator (?) can handle them.

This can be seen in e.g. the RunsOn service, where they have routing keys like this for self-hosted runners:

    runs-on:
      - runs-on=${{ github.run_id }}
      - runner=2cpu-linux-arm64

We should figure out a way to handle these. In practice there's probably nothing fully general here; we'll just need to walk the runs-on labels and flag anything that isn't a well-known label (which is a static list provided by GH itself).