chore: Cherry-picked changes from upstream

action.yml

@@ -7,6 +7,9 @@ inputs:
   version:
     required: false
     description: The version of mise to use. If not specified, will use the latest release.
+  sha256:
+    required: false
+    description: The SHA256 checksum of the mise binary to verify the download.
   mise_dir:
     required: false
     description: |

src/index.ts

@@ -226,6 +226,19 @@ async function setupMise(version: string): Promise<void> {
         break
     }
   }
+  // compare with provided hash
+  const want = core.getInput('sha256')
+  if (want) {
+    const hash = crypto.createHash('sha256')
+    const fileBuffer = await fs.promises.readFile(miseBinPath)
+    const got = hash.update(fileBuffer).digest('hex')
+    if (got !== want) {
+      throw new Error(
+        `SHA256 mismatch: expected ${want}, got ${got} for ${miseBinPath}`
+      )
+    }
+  }
+
   core.addPath(miseBinDir)
 }