fix(sec-auto): aikido Fix 8 security issues in @actions/core, @actions/github, undici

[aikido-autofix]

AI AutoFix

These PRs will require human vetting and potentially some fixes to fully integrate with the codebase.

Upgrade @actions/core, @actions/github, and undici to fix critical HTTP request smuggling, DoS via decompression bombs, unbounded compression chains, and invalid zlib parameters.

⚠️ Breaking changes analysis not available for: @actions/core, @actions/github

✅ No breaking changes for: undici

✅ 8 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-1525	🚨 CRITICAL	[undici] Duplicate HTTP Content-Length headers with case-variant names are allowed, creating malformed requests that can cause denial of service or enable HTTP request smuggling attacks in inconsistent header interpretation scenarios.
CVE-2026-1526	HIGH	[undici] A malicious WebSocket server can send compressed frames that expand to extremely large sizes in memory without limits, causing denial-of-service through memory exhaustion and process crash. The vulnerability stems from unbounded decompression in the permessage-deflate extension without size validation.
CVE-2026-2229	HIGH	[undici] A malicious WebSocket server can crash the client process by sending an invalid server_max_window_bits parameter in the permessage-deflate extension, causing an uncaught RangeError when creating a zlib decompressor with an out-of-range value.
CVE-2026-22036	HIGH	[undici] An unbounded decompression chain vulnerability allows a malicious server to insert thousands of compression steps, causing excessive CPU usage and memory allocation. This results in denial of service through resource exhaustion.
AIKIDO-2024-10065	MEDIUM	[undici] Affected versions of the undici library are vulnerable to memory leaks. By making multiple fetch requests with the same AbortSignal, undici adds event listeners without removing them, leading to excessive memory consumption.
AIKIDO-2026-10022	MEDIUM	[undici] A malicious server can send HTTP responses with excessive layered Content-Encoding headers, forcing the client into recursive decompression that exhausts CPU and memory resources, causing denial-of-service. This was mitigated by limiting the encoding chain to a maximum of 5 layers.
CVE-2026-1527	MEDIUM	[undici] HTTP request smuggling vulnerability allowing CRLF injection through the upgrade option, enabling arbitrary header injection and premature request termination to smuggle data to non-HTTP services.
AIKIDO-2025-10564	MEDIUM	[@fastify/busboy] Improper parsing of quoted filename parameters allows attackers to bypass file extension validation by appending forbidden extensions outside closing quotes, potentially enabling malicious script execution or XSS attacks.