Bump the github-actions group across 1 directory with 3 updates (#57)

Author: dependabot[bot]

.github/workflows/_scorecard.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           persist-credentials: false
       - name: ✅ run scorecard analysis
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/contributor-report.yml

@@ -44,7 +44,7 @@ jobs:
           ORGANIZATION: ${{ matrix.org }}
           LINK_TO_PROFILE: "True"
       - name: 📥 create issue
-        uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # v5.0.1
+        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
         with:
           title: "📰 Monthly Contributor Report: ${{ matrix.org }}"
           token: ${{ secrets.BLOOMBERG_OSS_USER_TOKEN_READ }}

.github/workflows/dependency-review.yml

@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
     steps:
       - name: 🔒 harden runner
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
             egress-policy: audit
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0