Check for script injection risks in CI examples

[sourcefrog]

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections