package.json is bundled into the generated JavaScript

[RA80533]

As a result:

• Trivial changes to package.json, such as dependency updates, require the project to be rebuilt in full
• Developers making any changes to the final bundle will have personal information leakage in the form of local file system paths being exposed and bundled in the generated JavaScript (see 3.3.6: What are absolute file paths in package.json used for? npm/npm#10393)

The project has an implicit dependency on an old version of @octokit/rest, the source of the behavior being exhibited, through an outdated version of @actions/github:

checkout/package-lock.json

Lines 17 to 26 in 25a956c

	"@actions/github": {
	"version": "2.2.0",
	"resolved": "https://registry.npmjs.org/@actions/github/-/github-2.2.0.tgz",
	"integrity": "sha512-9UAZqn8ywdR70n3GwVle4N8ALosQs4z50N7XMXrSTUVOmVpaBC5kE3TRTT7qQdi3OaQV24mjGuJZsHUmhD+ZXw==",
	"requires": {
	"@actions/http-client": "^1.0.3",
	"@octokit/graphql": "^4.3.1",
	"@octokit/rest": "^16.43.1"
	}
	},

Related #538