Review yq dependency security

[aholmes]

While we don't currently have a process for this, we do need to take the time to examine our dependency supply chain and document our use of this Action. This also includes ensuring we are prepared should this Action open us to any security problems, or avoiding pulling in vulnerable dependencies. This is non-blocking pending publishing a relative SOP.

Originally posted by @aholmes in #14 (comment)