False-negative: head_branch variable is not reported as untrusted

[jotak]

This should be considered untrusted:

    steps:
      - name: extract PR data
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pr_json=$(gh api "repos/${{ github.repository }}/pulls?state=open&head=${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }}")
          # ...

As the branch name can be crafted with malicious code/shell. It should be considered untrusted, similarly to github.event.head_commit.message.