build(deps): bump the github-actions group across 1 directory with 3 updates - #172

GitHub Actions cache poisoning: a workflow either restores a build cache in a release/publishing context (where an attacker who poisoned the cache via a lower-privileged run can have malicious content shipped), or caches inside a job that checks out untrusted PR code (letting attacker code write into a cache key trusted runs later restore). The Actions cache is shared across refs, so a poisoned entry crosses the trust boundary. Do not cache in jobs that run untrusted code, and avoid restoring untrusted caches in release jobs.