fix: update codeql-scanning.yaml

.github/workflows/codeql-scanning.yaml

@@ -21,6 +21,19 @@ jobs:
       pull-requests: read
 
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911
+      with:
+        egress-policy: block
+        allowed-endpoints: >
+          api.github.com:443
+          ghcr.io:443
+          github.com:443
+          pkg-containers.githubusercontent.com:443
+          proxy.golang.org:443
+          storage.googleapis.com:443
+          sum.golang.org:443
+
     - name: Checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
       with:

.github/workflows/main.yaml

@@ -46,8 +46,10 @@ jobs:
             proxy.golang.org:443
             storage.googleapis.com:443
             sum.golang.org:443
+
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
       - name: Set up Go
         uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
         with:
@@ -57,6 +59,7 @@ jobs:
           make deps
           export PATH=$PATH:$(go env GOPATH)/bin
           make lint
+
   test:
     runs-on: ubuntu-latest
     steps: