GitHub actions/checkout update blocks pwn request attacks

GitHub updated its official actions/checkout to block pwn request attacks that exploit the pull_request_target trigger. The update, effective June 18, 2026, prevents malicious code from running with full workflow privileges. This move strengthens software supply chain security by closing a common attack vector.