secrets-outside-env: flag secrets in reusable workflow calls

[woodruffw]

We now emit auditor level findings for this audit on the callsites for reusable workflows, i.e. jobs that call a reusable workflow and reference secrets in their own context, since reusable workflow jobs can't currently explicitly activate an environment (and reusable workflows that indirectly activate an environment can't read that environment's secrets).

@marcoieni PTAL if you have time 🙂

See #1773.

[marcoieni]

This works for me, thanks!
For unexperienced users, it might be useful to explain that in this case, converting to a github action or inlining the github action are the best ways to solve this.
Otherwise people might try to add environment: to the workflow only to find out later that it's not allowed.