include-actions in exclusions file has no effect on Data Exfiltration finding category

[nitrocode]

Summary

The exclusions file generated by cloudsplaining create-exclusions-file includes an include-actions key with a comment implying it extends the Data Exfiltration detection list:

Read-only actions to include in the results, such as s3:GetObject. By default, it includes Actions that could lead to Data Exfiltration

In practice, include-actions is never read by the Data Exfiltration finding logic. It only affects the unrelated Infrastructure Modification (Write / Permissions Management / Tagging) finding category.

Where this breaks down

• cloudsplaining/shared/constants.py defines READ_ONLY_DATA_EXFILTRATION_ACTIONS as a hardcoded list (currently s3:GetObject, ssm:GetParameter, ssm:GetParameters, ssm:GetParametersByPath, secretsmanager:GetSecretValue).
• cloudsplaining/output/policy_finding.py, the data_exfiltration property, calls self.policy_document.allows_specific_actions_without_constraints(READ_ONLY_DATA_EXFILTRATION_ACTIONS) and filters only against self.exclusions.exclude_actions. It never references self.exclusions.include_actions.
• exclusions.include_actions is only consumed in cloudsplaining/scan/statement_detail.py, inside missing_resource_constraints_for_modify_actions, which feeds the Infrastructure Modification finding, a completely separate category from Data Exfiltration.

So there is no code path by which adding an action to include-actions can cause it to appear in the Data Exfiltration finding, no matter what the exclusions-file template comment says.

Repro

1. Generate an exclusions file: cloudsplaining create-exclusions-file
2. Add s3:ListBucket to include-actions:

   include-actions:
     - "s3:ListBucket"

3. Scan a policy that grants only s3:ListBucket (no resource constraint) and does not grant any action already in the hardcoded READ_ONLY_DATA_EXFILTRATION_ACTIONS list, e.g.:

   {
     "Version": "2012-10-17",
     "Statement": [
       { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "*" }
     ]
   }

4. Run cloudsplaining scan with that exclusions file against the policy.
5. Observe: no Data Exfiltration finding is produced for s3:ListBucket, despite it being explicitly added to include-actions.

Proposed fix (pick one)

Option A - wire up include-actions to Data Exfiltration: update the data_exfiltration property to union exclusions.include_actions into the action list passed to allows_specific_actions_without_constraints, so the property behaves as the generated template comment describes.

Option B - fix the documentation instead: if include-actions is intentionally scoped to Infrastructure Modification only, update the comment generated by create-exclusions-file to say so.

Either direction resolves the mismatch; maintainers should pick based on intended design.