fix: detect committer fields as untrusted input in dangerous workflows

[avasis-ai]

Summary

The dangerous workflow check detects head_commit.author.{email,name} and commits[*].author.{email,name} as untrusted input, but does not detect the equivalent committer fields. The committer fields are equally attacker-controlled and should be flagged as dangerous.

Changes

• Added head_commit.committer.{email,name} and commits[*].committer.{email,name} to the untrusted context pattern regex
• Added corresponding test cases for all new patterns

References

• Mentioned in Dangerous Workflow: some user input are not being detected as untrusted input. #3915: @pnacht noted that github.event.{head_commit/commits[*]}.committer.{name/email} are potentially risky but not covered
• GitHub's untrusted input documentation