ci: enforce ignore-scripts policy for Node package managers

.yarnrc.yml

@@ -15,3 +15,4 @@ logFilters:
     level: discard
 
 nodeLinker: node-modules
+enableScripts: false

package.json

@@ -23,7 +23,7 @@
   "license": "Apache-2.0",
   "packageManager": "yarn@4.9.2",
   "dependencies": {
-    "@actions/core": "^3.0.1",
+    "@actions/core": "^3.0.0",
     "@docker/actions-toolkit": "^0.90.0",
     "js-yaml": "^4.1.1"
   },

yarn.lock

@@ -2784,7 +2784,7 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "docker-setup-buildx@workspace:."
   dependencies:
-    "@actions/core": "npm:^3.0.1"
+    "@actions/core": "npm:^3.0.0"
     "@docker/actions-toolkit": "npm:^0.90.0"
     "@eslint/js": "npm:^9.39.3"
     "@types/js-yaml": "npm:^4.0.9"