verify:action-pins: match expression contexts and job names case-insensitively #4934

Problem

scripts/verify-action-pins.mjs (added by #4928 for #4873) reads GitHub expressions with case-sensitive patterns, but GitHub resolves expression contexts and their keys without regard to case. Two spellings therefore pass the guard when they should not.

1. A secret in a mixed-case context. ${{ SECRETS.DEPLOY_TOKEN }} hands the job a secret, but handedSecret looks for a lowercase secrets, so the job is not counted as credentialed and its tag-pinned actions are not reported. The GITHUB_TOKEN exemption is case-sensitive in the same way.
2. The needs context in mixed case. ${{ NEEDS.detect.outputs.expected }} is not matched by the outputs rule. ${{ needs.DETECT.outputs.expected }} is matched, but the captured name DETECT is then looked up in workflow.jobs as written and does not resolve to the job detect. Either way the job that produced the outputs is not held to the pin.

Neither spelling exists in this repository's workflows: every expression here writes its contexts in lowercase. So nothing is exposed today. The gap is that the guard would not notice if one were added.

Reproduce

In a throwaway workflow:

jobs:
  publish:
    steps:
      - uses: actions/checkout@v6
      - env:
          KEY: ${{ SECRETS.DEPLOY_TOKEN }}
        run: publish

credentialedJobs returns an empty set, and unpinnedRefs reports nothing. With secrets.DEPLOY_TOKEN it reports actions/checkout@v6.

Expected

• secrets, needs, the GITHUB_TOKEN name and job ids are matched without regard to case, with job names resolved against workflow.jobs case-insensitively.
• Regression tests for SECRETS.X, Secrets['github_token'] (still exempt), NEEDS.job.outputs and needs.JOB.outputs.

Background

Raised by Copilot in round 15 of the review of #4928 and declined there as hardening beyond #4873, which asked for the guard to catch a tag-pinned action in a credentialed job or in a job whose artifact one downloads. By then the review had extended the guard five times for spellings no workflow here uses; this one is worth doing, on its own.

The MCP Inspector's guard, which this one was ported from, has the same case-sensitive matchers, so the fix is worth offering there too.