[jku]

The named actor can now be user, group or an app. This covers:

• PR bypass list
• Dismissal restrictions
• Push restrictions

If the app is named "my-app" then the item in the list needs to be "my-app[bot]":

• Purpose of the postfix is to prevent users/apps from shadowing each others namespaces: user and group names cannot have "[]" in them
• we could use an alternative syntax like "app:my-app" but I chose this one since it matches what ends up being visible in GitHub comments

[jku]

If the app is named "my-app" then the item in the list needs to "my-app[bot]" (we could use an alternative syntax like "app:my-app" but I chose this one since it matches what ends up being visible in GitHub comments). This prevents users/apps from shadowing each others namespaces: user names cannot have "[]" in them.

This is the potentially problematic part here... but since this is just used sigstore/community I don't see a major risk: if we need to change this syntax later that's still fine