How to Harden GitHub Actions: The Unofficial Guide