Add tests for config.AllowOnlyPolicy.UnmarshalJSON and NormalizeScopeKind

Improve test coverage for guard_policy.go:

- AllowOnlyPolicy.UnmarshalJSON: 67.7% → 93.5%
  - Add error-path tests for all 9 JSON fields (repos, min-integrity,
    blocked-users, approval-labels, trusted-users, endorsement-reactions,
    disapproval-reactions, disapproval-integrity, endorser-min-integrity)
  - Add happy-path tests for the 4 previously-untested fields:
    endorsement-reactions, disapproval-reactions, disapproval-integrity,
    endorser-min-integrity

- NormalizeScopeKind: 0% → 100%
  - Test nil input, empty map, missing scope_kind, lowercase, uppercase,
    leading/trailing spaces, non-string value, preservation of other fields,
    and immutability of the input map

- GuardPolicy.UnmarshalJSON: coverage improved with invalid-inner-JSON paths

- NormalizeGuardPolicy: 97.8% → 98.9%
  - Add tests for endorsement/disapproval dedup and validation logic

- ValidateWriteSinkPolicy: add nil-input test

Overall config package coverage: 92.2% → 93.8%

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]