Adopt StepSecurity Harden Runner for GitHub Actions

Nessuno ha ancora preso questa issue.

The StepSecurity Harden Runner GitHub Action contains a Go-based client which would audit and, if configured, restrict the following:

- **Of Interest:**
- Source code overwriting
- Network activity
- **Others (not as relevant):**
- GitHub Action workflow permission
- GitHub Action pinning

Limitations:

- Ubuntu OS only
- GitHub Actions only (No Travis CI or AppVeyor)
- Does not work with container-based actions (Requires `sudo` privileges)

Although StepSecurity's _Online Tool_ is referenced by the [OpenSSF Scorecard Guide](https://github.com/ossf/scorecard/blob/58608966196896da7ff7c015dbc427a76088afd0/docs/checks.md#write-permissions-causing-a-large-reduction), the "Harden Runner" _GitHub Action_ is not actually referenced or recommended. However, "Harden Runner" is used [within the OpenSSF Scorecard GitHub Repository](https://github.com/ossf/scorecard/pull/1733) itself.

StepSecurity Harden Runner GitHub Repository: https://github.com/step-security/harden-runner

Loosely-related to https://github.com/loopbackio/security/issues/25 (Part of OpenSSF Scorecard check).

## GitHub repositories

- [x] [loopback/cicd](https://github.com/loopbackio/cicd) ([PR](https://github.com/loopbackio/cicd/pull/70))
- [ ] [loopback/loopback.io](https://github.com/loopbackio/cicd) ([PR](https://github.com/loopbackio/loopback.io/pull/2049))

Esamina le configurazioni di GitHub Actions e le PR a cui si fa riferimento per loopback/cicd e loopback/loopback.io, quindi confronta l’adozione proposta con le limitazioni di StepSecurity Harden Runner per Ubuntu, sudo e container-action. Il lavoro è completato quando i repository interessati utilizzano l’action per verificare i rischi indicati e la checklist del repository ne riflette lo stato.

Scritto dal modello di indicizzazione a partire dal testo della issue.