check_function_argument_names() validated regular, *args, **kwargs and
keyword-only parameter names against the leading-underscore rule, but
omitted positional-only parameters (those before '/'). A positional-only
parameter could therefore be given a protected/injected name and a
default value, shadowing an injected guard hook (_getattr_, _getitem_,
_write_, _print_) so that generated guard calls resolve to an
attacker-controlled local instead of the safe policy hook.

Adds regression tests covering positional-only parameters (with and
without a default) and the equivalent lambda case.

Co-authored-by: Neroli-realy <[email protected]>