safe-outputs: pre-flight workflow scope check + full-branch allowed_files validation

safe-outputs: pre-flight workflow scope check + full-branch allowed_files validation #23040