v19.98.6

What's Changed

• fix(sandbox): resolve $HOME like ~, and refuse a redirect target we cannot resolve by @robinmordasiewicz in #2552
• ci: pin third-party actions where a credential is in reach, and enforce it by @robinmordasiewicz in #2556
• chore: bump version to v19.98.6 by @robinmordasiewicz in #2557

Full Changelog: v19.98.5...v19.98.6