Action does not validate that the `SLACK_WEBHOOK_URL` is a valid Slack webhook URL

The GitHub action does not validate that the passed Slack webhook URL is a valid Slack webhook URL. Thus, an attacker can pass URLs that do not have the format https://hooks.slack.com/*.

If an attacker attacks a GitHub workflow which uses the Slack GitHub action and manages to set the SLACK_WEBHOOK_URL environment variable, they can make the Slack GitHub action send requests to any arbitrary URL (incl. servers on internal networks, or ports on the same machine). That's classic SSRF.

The Slack GitHub action should validate that the passed webhook URL is a valid webhook URL, i.e., has the format https://hooks.slack.com/*.

This is where the environment variable is being read: https://github.com/slackapi/slack-github-action/blob/9a2e0ee8deeff80fa9eb79bec773084babe367a5/src/config.js#L121

This is where the request is being sent, with no validation of the webhook URL: https://github.com/slackapi/slack-github-action/blob/9a2e0ee8deeff80fa9eb79bec773084babe367a5/src/webhook.js#L26

I tried reporting this vulnerability responsibly through Slack's HackerOne program, but was told that this was not a security vulnerability. I still believe it should be fixed. Hence, this GitHub issue.

As an aside, similar attacks might (or might not) be possible for the API URL or the HTTPS proxy (I haven't had time to look into those): https://github.com/slackapi/slack-github-action/blob/9a2e0ee8deeff80fa9eb79bec773084babe367a5/src/config.js#L106-L117

Start in src/config.js at the SLACK_WEBHOOK_URL handling and follow the value into src/webhook.js, where the request is sent. Confirm the action rejects URLs unless they use the https://hooks.slack.com/* format, while preserving valid webhook behavior; verify this with the repository's existing checks.