Feature request: Detect expression injection in service options

[johnbillion]

GitHub Actions workflows supports a services directive to start containers. Each service can be provided an options argument as a string which is passed to the docker command when starting the container. Here's an example:

services:
  database:
    image: mysql:5.7
    options: >-
      --health-cmd="mysqladmin ping"
      --health-interval="30s"
      --health-timeout="10s"
      --health-retries="5"
      --entrypoint "${{ matrix.entrypoint }}"

This example contains an expression injection vulnerability via the matrix value. It would be great if Octoscan could detect this and flag it as an error just as it does for expressions in run directives.

[hugo-syn]

Should not be to complicated to implement I'll do this :)

[hugo-syn]

Hi @johnbillion could you try commit 92bfbdb and tell me if it's good for you ?