Adopt StepSecurity Harden Runner for GitHub Actions

The StepSecurity Harden Runner GitHub Action contains a Go-based client which would audit and, if configured, restrict the following:

- **Of Interest:**
- Source code overwriting
- Network activity
- **Others (not as relevant):**
- GitHub Action workflow permission
- GitHub Action pinning

Limitations:

- Ubuntu OS only
- GitHub Actions only (No Travis CI or AppVeyor)
- Does not work with container-based actions (Requires `sudo` privileges)

Although StepSecurity's _Online Tool_ is referenced by the [OpenSSF Scorecard Guide](https://github.com/ossf/scorecard/blob/58608966196896da7ff7c015dbc427a76088afd0/docs/checks.md#write-permissions-causing-a-large-reduction), the "Harden Runner" _GitHub Action_ is not actually referenced or recommended. However, "Harden Runner" is used [within the OpenSSF Scorecard GitHub Repository](https://github.com/ossf/scorecard/pull/1733) itself.

StepSecurity Harden Runner GitHub Repository: https://github.com/step-security/harden-runner

Loosely-related to https://github.com/loopbackio/security/issues/25 (Part of OpenSSF Scorecard check).

## GitHub repositories

- [x] [loopback/cicd](https://github.com/loopbackio/cicd) ([PR](https://github.com/loopbackio/cicd/pull/70))
- [ ] [loopback/loopback.io](https://github.com/loopbackio/cicd) ([PR](https://github.com/loopbackio/loopback.io/pull/2049))

Review the GitHub Actions configurations and the referenced PRs for loopback/cicd and loopback/loopback.io, then compare the proposed adoption with StepSecurity Harden Runner's Ubuntu, sudo, and container-action limitations. Done means the applicable repositories use the action to audit the stated risks and the repository checklist reflects their status.

Written by the indexing model from the issue text.