Backend drops dynamic GH_REQUIRED_CHECK_* controls, breaking ORG_SOURCE_ status-check policies

[CarlAllenn]

Summary

Backend.GetBranchControlsAtCommit (pkg/sourcetool/backends/vcs/github/github.go) builds its result by copying observed controls onto slsa.NewControlSet() — a fixed enumeration of framework controls. Dynamic control names, i.e. GH_REQUIRED_CHECK_<check> produced by computeRequiredChecks, are not in that fixed list, so they are silently dropped.

Consequence: any policy using org_status_check_controls fails with

error computing branch controls: policy requires check 'ci / ci', but that control is not enabled

even when the required check is correctly configured (Actions integration id bound, ruleset active, commit pushed after enforcement start). Verified by probing ghcontrol.GetBranchControlsAtCommit directly, which does return the GH_REQUIRED_CHECK_* control — it's lost in the backend mapping.

Repro

1. Ruleset requiring a status check bound to GitHub Actions (integration id 15368).
2. Policy with an org_status_check_controls entry for that check.
3. sourcetool checklevelprov ... --use_local_policy policy.json → "control is not enabled".

Fix that worked for us

After the fixed-set mapping loop, append observed controls that have no slot in the fixed list:

	// Carry over dynamic controls (e.g. GH_REQUIRED_CHECK_*) that are not
	// part of the fixed framework control list and would otherwise be
	// silently dropped.
	for _, c := range activeControls.Controls {
		if status.GetControl(c.Name) == nil {
			cc := c
			cc.State = slsa.StateActive
			status.Controls = append(status.Controls, cc)
		}
	}

With this (plus #433), the emitted VSA correctly carries the ORG_SOURCE_ property. Happy to send a PR.