github: GitHub Actions holds potentially malicious workflows for approval

GitHub Actions now requires approval for potentially malicious workflow changes in public repositories to mitigate supply-chain abuse from compromised credentials, aiming to protect CI/CD secrets and prevent follow-on attacks.