Actions: improve improper access control query

[redsun82]

The query was firing an alert only when both unsafe conditions were met:

• a synchronize trigger
• a mutable reference checkout

However, both these can cause problems alone. The query has thus been changed to detect either of the two, rather than both conditions at the same time.

Closes: https://github.com/github/codeql/issues/20706