support yaml mapping strings, reduce injection risks

[jenseng]

Simplify usage and improve security

1. with as a YAML mapping string

Now you can specify the with input as a YAML mapping string, e.g.

- uses: jenseng/dynamic-uses@v1
  with:
    uses: actions/setup-node@${{ inputs.actionVersion }}
    with: |
      node-version: 18
      cache: npm

Note that JSON still works, since it's a subset of YAML.

2. Reduce injection risks

As part of implementing this, we now reduce the risks around YAML injection when with contains untrusted expressions. E.g. it's no longer possible to inject more steps to the action, since all lines are fully indented.

That said, additional inputs could still be injected to the dynamically called action. There's no way for dynamic-uses to prevent this, since from its perspective the with input is an opaque string of inputs that are presumably trustworthy. So the overall guidance is unchanged in that every expression used in with should be made YAML-safe via toJSON

[jsoref]

clever action. I've done things like this but hadn't actually gotten around to making a truly generic version.