Allow opting out of Detection Runs issues without disabling threat detection

[myaschmitz]

Problem

We use gh-aw for issue triage across Azure Verified Modules Terraform repositories. Framework diagnostics appear alongside user-reported module bugs.

In v0.85.4, [aw] Detection Runs issue reporting cannot be disabled independently of threat detection. The existing report-failure-as-issue and report-failed-jobs settings do not control this reporting path.

Our two detection trackers contain three parse_error reports, rather than confirmed threats:

• [aw] Detection Runs Azure/terraform-azurerm-avm-res-managedidentity-userassignedidentity#132
• [aw] Detection Runs Azure/terraform-azurerm-avm-ptn-example-repo#198

These reports are useful for diagnosing automation problems, but module issue queues are not always the right destination. Closing a tracker does not opt out: a subsequent warning or failure can create another issue.

Proposed enhancement

Add an independent option to disable Detection Runs issue reporting. For example, the configuration could look like this:

safe-outputs:
  threat-detection:
    report-as-issue: false

This is proposed syntax, not an existing setting.

Expected behavior

• Preserve current issue reporting by default.
• When disabled, skip creating detection tracker issues and posting comments to them.
• Continue running threat detection.
• Preserve existing enforcement and continue-on-error behavior.
• Keep detection results available through GitHub Actions diagnostics.

The goal is to separate security enforcement from its reporting destination, not suppress detection or weaken its safeguards.