Ensure cloud-related GitHub actions follow recommended security procedures

[bsweger]

At a recent demo, @annakrystalli raised the good point of ensuring that Hubverse GitHub actions that interact with AWS are as secure as possible.

Anna specifically asked if there is a way to programmatically ensure that a repo has branch protections enabled before our cloud-based actions will run.

In addition, this GitHub writeup has additional security-hardening tips that we should strive to apply:

• [x] Appropriate secret handling (n/a, since we're using an openId connect provider)
• [x] Ensure that secrets are minimally scoped (👍 since each hub will have it's own single-purpose IAM role)
• [ ] Monitor changes to workflow files
• [ ] Mitigate script injection risk (applicable, as we are using bash commands for the S3 sync)
• [ ] Ensure workflow tokens don't have more permissions than needed
• [ ] Use code scanning on cloud-related actions
• [ ] Use Dependabot to ensure that workflow actions are kept up-to-date
• [ ] Prevent GitHub actions from creating and approving PRs
• [ ] Audit GitHub logs for security-related events (e.g., events related to branch protections)
• [ ] Require approval for all workflow runs by outside collaborators

In the context of the Hubverse, we might also consider:

• [ ] Creating an "allow" list of data types permitted to be pushed to S3 (e.g., .txt, .json, .yaml, .parquet, .csv, .tsv.... basically things that can't contain a malicious payload)

[bsweger]

Many (most) of these hardening suggestions involve updating repo settings (i.e., settings that the Hubverse team does not have access to).

We'll have to do some thinking about which of them we want to try enforcing programmatically (if possible).

[bsweger]

Another useful resource: https://engineering.salesforce.com/github-actions-security-best-practices-b8f9df5c75f5/

[annakrystalli]

I feel security issues resulting from running custom validation functions is also an important topic that we haven't put much thought into and this might be a good opportunity to: https://github.com/Infectious-Disease-Modeling-Hubs/hubValidations/issues/20