Analyse for workflow weaknesses

We ought to check for security weaknesses in the security of our GitHub Actions workflows, particularly as this repository may accept PRs from non-members. There's a tool that can do this. I'm using it in another repository.

OK, I've a set of suggested changes, but I now need to revalidate that they do the right thing! I can write reasonable shell scripts from memory, but I'm much more of a Powershell neophyte!