Feature: bot-conditions should consider github.triggering_actor as well #550

Pre-submission checks

• I am not reporting a bug (crash, false positive/negative, etc). These must be filed via the bug report template.
• I have looked through the open issues for a duplicate request.

What's the problem this feature will solve?

The bot-conditions audit currently just considers github.actor, but github.triggering_actor is similarly susceptible to spoofing.

There are probably others as well, but covering this one would be a good self-contained improvement.

Describe the solution you'd like

See above.

Additional context

No response