Audit idea: Secrets outside of environments

[woodruffw]

Discussed in #181

^{Originally posted by AndrewMohawk November 19, 2024}
Loving the tool so far! I'd love to have zizmor also determine secrets referenced outside of environments within GH actions. I see it fairly often and it means that if anyone has the ability to create a PR with an updated workflow they can exfil secrets that arent tied to an environment (and that environment having branch protections). The caveat here is that an attacker would have had to submit a PR before the malicious one (usually you would see them as doing typo fixes first).

[woodruffw]

Additional context in #181; this is something we could do, but requires a more privileged GH_TOKEN than is typical. So some thought needs to go into how we expose this/warn users when it's being skipped due to insufficient permissions.