[REVIEW] container-security: add workload identity token audience and finalizer ownerReference traversal gates

[JamesJi79]

Adds two review gates for container-security skill:

1. Workload Identity Token Audience Scope Gate (closes [REVIEW] container-security: add workload identity token audience scoping gates #2671)

   • Token audience scope validation check
   • Token mount scope check

2. Kubernetes Finalizer and OwnerReference Traversal Gate (closes [REVIEW] container-security: add Kubernetes finalizer ownerReference takeover gates #2670)

   • OwnerReference validation check
   • Finalizer abuse prevention check

Both gates add evidence requirements for common Kubernetes/container false-positive patterns.

[github-actions]

Thanks for the submission! 🙏 SecuritySkills is now issue-first: contributions need a linked issue that a maintainer has marked approved before a PR is opened.

Please open an issue describing the skill, wait for the approved label, then reopen this PR with Closes #<issue> in the description. The PR template lists everything we'll look for (including an independently runnable reproduction).