Security patches

[liquidsec]

Summary

• Harden docker_pull WWW-Authenticate parsing and realm validation
• Add path traversal check to unarchive module
• Reject symlinks in github_workflows output path before mkdir

[github-actions]

🚀 Performance Benchmark Report

⚠️ No current benchmark data available

This might be because:

• Benchmarks failed to run
• No benchmark tests found
• Dependencies missing

[codecov]

Codecov Report

❌ Patch coverage is 95.12195% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 90%. Comparing base (015020c) to head (2bdec88).

Files with missing lines	Patch %	Lines
bbot/modules/github_workflows.py	80%	4 Missing ⚠️
bbot/modules/internal/unarchive.py	86%	4 Missing ⚠️
...tep_2/module_tests/test_module_github_workflows.py	95%	2 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##             dev   #3196    +/-   ##
======================================
+ Coverage     90%     90%    +1%     
======================================
  Files        449     449            
  Lines      44451   44649   +198     
======================================
+ Hits       39765   39965   +200     
+ Misses      4686    4684     -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.