Harden community submission workflow output allowlists (#4103)

* Harden community submission workflow outputs

Restrict extension and preset submission PRs to the expected catalog and docs files.

* test: check community allowlists pairwise

---------

Co-authored-by: root <kinsonnee@gmail.com>

Author: WOLIKIMCHENG

.github/workflows/add-community-extension.lock.yml

@@ -31,6 +31,9 @@ safe-outputs:
     labels: [extension-submission, automated]
     draft: true
     max: 1
+    allowed-files:
+      - extensions/catalog.community.json
+      - docs/community/extensions.md
     protected-files:
       policy: blocked
       exclude:

.github/workflows/add-community-extension.md

@@ -31,6 +31,9 @@ safe-outputs:
     labels: [preset-submission, automated]
     draft: true
     max: 1
+    allowed-files:
+      - presets/catalog.community.json
+      - docs/community/presets.md
     protected-files:
       policy: blocked
       exclude: