New audit: excessive secret provisioning

[woodruffw]

By default, the GitHub Actions runner will only include/inject explicitly referenced secrets. For example, if a repo has secrets.{foo,bar,baz} but workflow.yml only mentions secrets.{foo,bar}, then secrets.baz will not be included at runtime.

However, if the workflow references the entire secrets context, the runner can't filter the selected secrets and will instead include the entire context. For example:

# good: no other secrets added to runner
secrets.foo

# bad: adds all secrets to runner despite only accessing foo
fromJSON(secrets).foo

We should flag on any "bare" use of secrets.

Like #400, this is going to require some internal refactoring/rethinking to enable us to scan all expressions in the input, regardless of the context they appear in.