Actions: Do not treat job.workflow_* as untrusted input

[cplieger]

actions/untrusted-checkout/medium reports a reusable workflow that checks out its own source:

on:
  workflow_call:

jobs:
  checkout:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: ${{ job.workflow_repository }}
          ref: ${{ job.workflow_sha }}

The job.workflow_* context properties identify the workflow file that defines the running job, so this checkout fetches the code that is already running. GitHub's documentation uses this same step as its example for these properties.

When a reusable workflow has no caller in the analyzed repository, its trigger event is unknown, and GitHubEventJsonSource treats every expression in it as untrusted. This change excludes job.workflow_ref, job.workflow_sha, job.workflow_repository and job.workflow_file_path from that case.

I added reusable_workflow_self_checkout.yml to the CWE-829 query tests; it produces no results. All tests under actions/ql/test pass with CodeQL CLI 2.27.3.