build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1

Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 3.0.0 to 3.1.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](f8d387b68d...1b10c78c78)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -19,8 +19,6 @@ updates:
       interval: "daily"
     cooldown:
       default-days: 2
-      exclude:
-        - "@docker/actions-toolkit"
     versioning-strategy: "increase"
     groups:
       aws-sdk-dependencies:

.github/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Test
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           source: .
           targets: test

.github/workflows/update-dist.yml

@@ -21,7 +21,7 @@ jobs:
       -
         name: GitHub auth token from GitHub App
         id: docker-read-app
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
           app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
           private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
@@ -35,7 +35,7 @@ jobs:
           token: ${{ steps.docker-read-app.outputs.token }}
       -
         name: Build
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           source: .
           targets: build

.github/workflows/validate.yml

@@ -26,7 +26,7 @@ jobs:
       -
         name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/matrix@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action/subaction/matrix@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           target: validate
 
@@ -41,6 +41,6 @@ jobs:
     steps:
       -
         name: Validate
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           targets: ${{ matrix.target }}

.github/zizmor.yml

@@ -0,0 +1,3 @@
+rules:
+  secrets-outside-env: # FIXME: remove this rule when zizmor 1.24.0 is released, fixing the right persona attached to this rule: https://github.com/zizmorcore/zizmor/pull/1783
+    disable: true

package.json

@@ -25,7 +25,7 @@
     "@actions/core": "^3.0.0",
     "@aws-sdk/client-ecr": "^3.1020.0",
     "@aws-sdk/client-ecr-public": "^3.1020.0",
-    "@docker/actions-toolkit": "^0.88.0",
+    "@docker/actions-toolkit": "^0.86.0",
     "http-proxy-agent": "^9.0.0",
     "https-proxy-agent": "^9.0.0",
     "js-yaml": "^4.1.1"

yarn.lock

@@ -85,21 +85,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@actions/github@npm:^9.1.0":
-  version: 9.1.0
-  resolution: "@actions/github@npm:9.1.0"
-  dependencies:
-    "@actions/http-client": "npm:^3.0.2"
-    "@octokit/core": "npm:^7.0.6"
-    "@octokit/plugin-paginate-rest": "npm:^14.0.0"
-    "@octokit/plugin-rest-endpoint-methods": "npm:^17.0.0"
-    "@octokit/request": "npm:^10.0.7"
-    "@octokit/request-error": "npm:^7.1.0"
-    undici: "npm:^6.23.0"
-  checksum: 10/ed5b50e5e4e59d4feeb2952f8f27ea50a7abc470f4a63b319ab009104f0729ef2788e164a07cf0cccdc7dd27352bad8599923906bcc7d19ea65309321a7fac45
-  languageName: node
-  linkType: hard
-
 "@actions/glob@npm:^0.6.1":
   version: 0.6.1
   resolution: "@actions/glob@npm:0.6.1"
@@ -894,15 +879,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@docker/actions-toolkit@npm:^0.88.0":
-  version: 0.88.0
-  resolution: "@docker/actions-toolkit@npm:0.88.0"
+"@docker/actions-toolkit@npm:^0.86.0":
+  version: 0.86.0
+  resolution: "@docker/actions-toolkit@npm:0.86.0"
   dependencies:
     "@actions/artifact": "npm:^6.2.1"
     "@actions/cache": "npm:^6.0.0"
     "@actions/core": "npm:^3.0.0"
     "@actions/exec": "npm:^3.0.0"
-    "@actions/github": "npm:^9.1.0"
+    "@actions/github": "npm:^9.0.0"
     "@actions/http-client": "npm:^4.0.0"
     "@actions/io": "npm:^3.0.2"
     "@actions/tool-cache": "npm:^4.0.0"
@@ -913,14 +898,14 @@ __metadata:
     async-retry: "npm:^1.3.3"
     csv-parse: "npm:^6.2.1"
     gunzip-maybe: "npm:^1.4.2"
-    handlebars: "npm:^4.7.9"
+    handlebars: "npm:^4.7.8"
     he: "npm:^1.2.0"
     js-yaml: "npm:^4.1.1"
     jwt-decode: "npm:^4.0.0"
     semver: "npm:^7.7.4"
     tar-stream: "npm:^3.1.7"
     tmp: "npm:^0.2.5"
-  checksum: 10/668c9fa85f60b478e92c2678f1f2aa6c68c7f36c9f76c0b953a68f86c785d10630316ab8465ebaf6a62ee854edc441f97c626d0055851a03f38c5eff13abe188
+  checksum: 10/89d65c4a48de7474d7356520b452a1f9ff1931e6bcb2b810a2e14b4b6efcdc1fb7d0d22771e94289b58ee57040a77792306a13dc898b2aa7e083124bee102f18
   languageName: node
   linkType: hard
 
@@ -3172,7 +3157,7 @@ __metadata:
     "@actions/core": "npm:^3.0.0"
     "@aws-sdk/client-ecr": "npm:^3.1020.0"
     "@aws-sdk/client-ecr-public": "npm:^3.1020.0"
-    "@docker/actions-toolkit": "npm:^0.88.0"
+    "@docker/actions-toolkit": "npm:^0.86.0"
     "@eslint/js": "npm:^9.39.3"
     "@types/js-yaml": "npm:^4.0.9"
     "@types/node": "npm:^24.11.0"
@@ -3803,7 +3788,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"handlebars@npm:^4.7.9":
+"handlebars@npm:^4.7.8":
   version: 4.7.9
   resolution: "handlebars@npm:4.7.9"
   dependencies: