Injections on a workflow_run triggered protected by a allow branches list should not be reported as critical