fix: upgrade actions deps to clear undici vulnerabilities

[anurag-stepsecurity]

Summary

• Bumped @actions/core → ^2.0.3, @actions/github → ^8.0.1, @actions/http-client → ^3.0.2 so the lockfile resolves undici@6.27.0 (fixes all reported undici advisories).
• Removed the unused @octokit/core override and cleared osv-scanner.toml ignores (no longer needed).
• Stayed on CommonJS (require + ncc CJS build); did not use npm overrides/resolutions. Rebuilt dist/.

Test plan

• npm install → 0 vulnerabilities
• osv-scanner -L package-lock.json → No issues found
• require('@actions/github'|'@actions/core') smoke test OK
• npm run build succeeds
• Public APIs used by the action (getInput/setOutput/getOctokit/request) still present