Included a feature for witness to be downloaded

[naveensrinivasan]

Witness Downloaded from Witness Repository

• The witness binary could become stale if it is in the repository.
• It is not recommended to have binary in the repository
• I don't know if the goal is not to download the binary

Changes in this PR

- The witness binary would be downloaded from the witness repo and validated
  for the checksum
- Included tests `__tests__/index.test.js`
- Removed node_modules dir
- Included `npm ci  run` have npm to be installed during runtime
- Fixed a few npm audit fixes.

[colek42]

We included the UPX packed binary in the repo to help the with performance. I wonder if there is a way we could use GitHub's cache to get the best of both worlds. I would certainly like to keep the binary out of this repo, it would make things much cleaner.

[naveensrinivasan]

UPX packed binary

What is the advantage of the UPX-packed binary? My ignorance.

How can the end-user trust the GH action with the binary without any provenance or verifiability? Probably, if the repo provides an answer for that, it would make it easier.