[AI-6502] Update dependency resolution dd-octo-sts policy (DataDog#23955)

* Update dd-octo-sts policy for resolve build deps

* revert workflow change

Author: sarah-witt

.github/chainguard/self.resolve-build-deps.push.sts.yaml

@@ -1,20 +1,18 @@
 # Policy for: .github/workflows/resolve-build-deps.yaml publish job in DataDog/integrations-core
-# Triggered by push to master or release branches, or workflow_dispatch
+# Triggered by push to feature branches that update dependencies
 #
 # Naming convention:
 #   self:               Only this repository (DataDog/integrations-core) can use this policy
 #   resolve-build-deps: Specific workflow
-#   push:               Primary trigger is push to protected branches
+#   push:               Primary trigger is push to feature branches
 #
 # Security model:
-#   - Publish job runs on push or workflow_dispatch to protected branches (master and X.Y.x)
+#   - Publish job runs on push to any feature branch
 #   - Workflow file must be committed to the same branch
-#   - Pull request events are excluded by the job's if condition
+#   - Access is scoped to this specific workflow file via job_workflow_ref
 #
 # Permissions granted:
-#   - contents: write       - Push commits to branches
-#   - pull_requests: write  - Create pull requests
-#   - workflows: write      - Modify workflow files in generated commits
+#   - contents: write  - Push commits (lockfiles) back to the feature branch
 #
 # Usage in workflows:
 #   - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
@@ -24,15 +22,12 @@
 
 issuer: https://token.actions.githubusercontent.com
 
-subject_pattern: repo:DataDog/integrations-core:ref:refs/heads/(master|\d+\.\d+\..*)
+subject_pattern: repo:DataDog/integrations-core:ref:refs/heads/.*
 
 claim_pattern:
-  event_name: (push|workflow_dispatch)
-  job_workflow_ref: DataDog/integrations-core/\.github/workflows/resolve-build-deps\.yaml@refs/heads/(master|\d+\.\d+\..*)
-  ref: refs/heads/(master|\d+\.\d+\..*)
+  event_name: push
+  job_workflow_ref: DataDog/integrations-core/\.github/workflows/resolve-build-deps\.yaml@refs/heads/.*
   repository: DataDog/integrations-core
 
 permissions:
   contents: write
-  pull_requests: write
-  workflows: write