RE001: read workflows as YAML does (quoted keys, aliases, with: inputs)

CHANGELOG.adoc

@@ -25,13 +25,21 @@ to declare egress instead of adopting harden-runner everywhere. RE001 now:
 * reports drift (the declaration and the workflow disagree on secrets) and stale
   declarations (the job is gone, runs elsewhere, or reads no real secret), and
   checks a declaration even when harden-runner satisfies the job, including a
-  claimed `:enforcement harden-runner-*` on a job that no longer installs it;
+  claimed `:enforcement harden-runner-*` on a job that no longer installs it,
+  and a claimed `harden-runner-block` on a step whose `with:` input (YAML
+  comments aside) leaves the policy at audit;
 * names the job and gives the exact `(job …)` entry in its fix text;
 * reads every `${{ … }}` expression whole, even one a folded scalar splits
   across lines, and counts only the top-level `secrets` context (matched
   without regard to case), in property or index form, outside string
   literals; a read by a key computed at run time (`secrets[env.X]`,
   `toJSON(secrets)`) is its own finding, since no declaration can list it;
+* reads the workflow as YAML does in two more ways: a quoted key (`"env":`,
+  `'runs-on':`) is the same key, and an alias (`env: *common`, `<<: *defaults`,
+  `run: *script`, `deploy: *build`) brings its anchor's node into the job that
+  uses it, a merge never overriding a key the job sets itself, within a budget
+  of copied lines that stops a "billion laughs" file; an alias is read only
+  where a YAML node starts, never inside a quoted or block scalar;
 * keeps #966's exposure model as the severity layer: an undeclared job is
   `:high` when the credential shares a step with fetched or untrusted code,
   and otherwise `:warn`, with or without an exposure (owner ruling