Signed-off-by: Felipe Zipitria <[email protected]>

* fix issue 4622
Test ID 941120-8

* Update tests/regression/tests/REQUEST-941-APPLICATION-ATTACK-XSS/941120.yaml

Co-authored-by: azurit <[email protected]>

* Update tests/regression/tests/REQUEST-941-APPLICATION-ATTACK-XSS/941120.yaml

Co-authored-by: azurit <[email protected]>

---------

Co-authored-by: azurit <[email protected]>

Update go-ftw and use the new `--store-failure-waf-logs` flag

resolves zizmor findings on .github/workflows/:

- add `persist-credentials: false` to all `actions/checkout` calls; the
  duty-scheduler push now uses an explicit token URL instead of relying
  on persisted creds (artipacked)
- restructure quantitative tests to the safe two-workflow pattern: the
  test job moves to `pull_request` (no secrets, read-only token) and a
  new `quantitative-comment.yaml` posts the result on `workflow_run`
  with `pull-requests: write`. comment posting uses `gh api` with a
  marker-based upsert, removing the `thollander/actions-comment-pull-request`
  third-party dependency. eliminates the `pull_request_target` + PR-head
  checkout pwn-request antipattern (dangerous-triggers)
- add `.github/zizmor.yml` with justified ignores for the remaining
  safe `pull_request_target` workflows (check-pr-dependencies,
  check-pr-title — metadata-only, no checkout) and the new
  `workflow_run`-triggered comment workflow (artifact-only, no PR code
  execution)

zizmor result: no findings reported (3 ignored, 35 suppressed)

Signed-off-by: Felipe Zipitria <[email protected]>