Actions: vacuous `author_association` check also suppresses code-injection alerts

[computersarebad]

Description of the issue

While working on #22368 I checked whether the other If-based control checks have the same problem that PR fixes for actor checks, and it seems AssociationIfCheck does.

Repro (CodeQL CLI 2.26.3, current query source):

name: repro
on:
  issues:
    types: [opened]
jobs:
  j:
    runs-on: ubuntu-latest
    if: github.event.pull_request.author_association != 'NONE'
    steps:
      - run: |
          echo '${{ github.event.issue.title }}'

No alert is reported. Remove the if: line and actions/code-injection/critical fires.

This is similar to #22367. The workflow only triggers on issues events, where github.event.pull_request is not populated, so the comparison is always true and any user who opens an issue reaches the injectable step. AssociationIfCheck matches github.event.comment.author_association, github.event.issue.author_association and github.event.pull_request.author_association anywhere in the condition without considering whether the field exists for the triggering event, and AssociationCheck then counts the job as protected for issues and the other events it covers.

I'd expect this shape to show up in the wild more often than the specific-actor version, since gating on author_association is a commonly recommended pattern for comment-triggered workflows.

Planning to send a PR for this once #22368 lands, since the fix builds on the same structure.