chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
step-security/harden-runner	action	minor	v2.16.1 → v2.17.0
trufflesecurity/trufflehog	action	patch	v3.94.2 → v3.94.3

---

Release Notes

step-security/harden-runner (step-security/harden-runner)

v2.17.0

Compare Source

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.