refactor(xtask): ADR-004 allowlist rows keyed on (class, service, rationale) instead of (file, pattern)

Today's allowlist entries pair file + pattern, producing 9 duplicate rows for the same legitimate cross-service exception (e.g., ievs_match_completed used in 9 different canopy-reporting files). A (class, service, rationale) form would collapse those 9 rows into one.

Extracted from adr-004-ssa-authorization-audit.adoc § Potential Improvements.