ops(josh-sync): Opt in to 6 additional lints

[hashcatHitman]

This PR opts rust-lang/josh-sync into 6 lints it was already passing without any fixes:

• adhoc-packages, tracked in Solve the adhoc-packages lint #48
• dangerous-triggers
• self-repository
• stale-actions-refs
• superfluous-actions
• unpinned-images

Opened in response to #83 (review), which I hope I didn't misunderstand.

A note on dependabot-cooldown:

It also passes dependabot-cooldown. This lint is specific to Dependabot. rust-lang/josh-sync passes because it is using Renovate, not Dependabot. The Renovate config uses the t-infra maintained "actions" config, which intentionally does not have a cooldown. So there may be some semantic reason to prefer to not opt-in, even though it passes. It seems like it's best to lave it disabled for now.

[ubiratansoares]

Thanks @hashcatHitman !

Regarding the Dependabot cooldown : if you don't use Dependabot and don't have plans to, I think that keeping related audits disabled is the correct approach, ie, one should opt-in if one wants to get a valid signal out of these audits.

Perhaps we could make this clear in our policy file (e.g. with comments). Meanwhile, let me know if that makes sense to you

[hashcatHitman]

Regarding the Dependabot cooldown : if you don't use Dependabot and don't have plans to, I think that keeping related audits disabled is the correct approach, ie, one should opt-in if one wants to get a valid signal out of these audits.

Perhaps we could make this clear in our policy file (e.g. with comments). Meanwhile, let me know if that makes sense to you

I can't say what the plans are in josh-sync, but I think they will probably stick with Renovate. So I can remove that commit, sure.

Personally, I see it one of two ways:

• The lint doesn't fire, so enabling it doesn't change anything unless you use Dependabot later on
• The lint doesn't fire, so enabling it may lead to incorrectly assuming it also applies to Renovate

To be clear, I'm not anyone with any particular authority over josh-sync. I'm just trying to fix as many issues as I can across all rust-lang public repositories with crabwatch enabled. (See: #t-infra > questions about helping with crabwatch/zizmor)