fix: exclude information about the repo and owner

[funnelfiasco]

This would seem to fall into the category of "if these values are unsafe, we have bigger problems to deal with"

[woodruffw]

Thanks @funnelfiasco! I think this is going to be similar to #128 -- excluding repository_id and repository_owner_id seems 100% right to me, but I need to think about the others.

(AFAIK repo/owner information is probably safe, but URL quoting/escaping isn't always super consistent, and there may be funny things that someone can do with Enterprise deployment URLs.)

[funnelfiasco]

Of course GitHub doesn't provide documentation on what's actually possible, but in the case of these values there's nothing an attacker could do to modify them. So even if it's possible and someone names their repository Robert'); DROP TABLE Students;-- then plenty of other things will probably break before they ever get to running a GitHub workflow.

[woodruffw]

Of course GitHub doesn't provide documentation on what's actually possible, but in the case of these values there's nothing an attacker could do to modify them.

I think that's right, except for in the fork context -- in that context the attacker controls all of these, but I agree that there's still no injection risk with them (I suppose someone could name their GitHub account reboot or something like that, but they still don't have the escape primitives needed).

Given that, I'm good with this. Thanks for the PR!