Feature: Allow excluding specific repositories from online audits (ref-confusion, known-vulnerable-actions) #2449

Pre-submission checks

• I am not reporting a bug (crash, false positive/negative, etc). These must be filed via the bug report template.
• I have looked through both the open and closed issues for a duplicate request.
• I affirm that I have followed the AI policy and that this request constitutes my own words and understanding.

What's the problem this feature will solve?

Some workflows use internal, private actions. For ref-confusion and known-vulnerable-actions, zizmor tries to resolve their refs via the GitHub API, which fails because the token has no access to these repos. The ref-pin policy only applies to unpinned-uses, so it doesn't cover this case. Granting the token read access to all internal repos isn't always an option. The internal action repositories are scanned separately, so excluding them here would not create a coverage gap.

Describe the solution you'd like

A config option to exclude specific repositories or owners from individual online audits, while those audits keep running for all other actions. For example (something along those lines...):`

rules:
  ref-confusion:
    config:
      ignore-uses:
        - "my-org/*"
  known-vulnerable-actions:
    config:
      ignore-uses:
        - "my-org/*"

so references would be skipped without an API call.

Additional context

No response