new audit: detect secrets: inherit in reusable workflows

[woodruffw]

Reusable workflows can be called with secrets: inherit, in which case they inherit the entire secrets namespace instead of a specific set of secrets explicitly forwarded to them. This violates the principle of least authority.

For example:

jobs:
  call-workflow:
    uses: octo-org/example-repo/.github/workflows/called-workflow.yml@main
    secrets: inherit

should generally be:

jobs:
  call-workflow:
    uses: octo-org/example-repo/.github/workflows/called-workflow.yml@main
    secrets:
      # explicitly forward just special-secret
      special-secret: ${{ secrets.special-secret }}

This one is pretty low-severity, but good for us to flag.

[woodruffw]

Done with #408.