Merge pull request #21574 from github/redsun82/actions/remove-harden-runner-false-positive

Remove false positive injection sink models for `docker/build-push-action` and `step-security/harden-runner`

Author: redsun82

actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Removed false positive injection sink models for the `context` input of `docker/build-push-action` and the `allowed-endpoints` input of `step-security/harden-runner`.