[TASK] Drop harden-runner so the workflows can start

Both new workflows opened with step-security/harden-runner. The
repository restricts Actions to an allowlist and harden-runner is not on
it, so the run ended in startup_failure before any step executed. This
never showed while the branch was conflicting, because a pull request
that cannot be merged produces no runs.

Remove the step from both workflows. Every remaining action matches the
allowlist. Getting harden-runner added to it would be the better fix and
is noted in the workflow header.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

.github/workflows/check-built-assets.yaml

@@ -39,18 +39,6 @@ jobs:
       contents: read
 
     steps:
-      - name: "Harden runner"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: block
-          disable-sudo: true
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
-            registry.npmjs.org:443
-
       - name: "Checkout"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/dependabot-rebuild-assets.yaml

@@ -16,10 +16,15 @@
 #     the PR opened with
 #   - lockfile-only diff guard: refuse to build if the PR changed anything
 #     other than package.json / package-lock.json
-#   - npm ci --ignore-scripts; harden-runner egress in block mode
+#   - npm ci --ignore-scripts
 #   - the App token is minted AFTER the build, so the untrusted build cannot
 #     read it; persist-credentials: false keeps it off disk
 #
+# Egress filtering via step-security/harden-runner is not available here: the
+# repository restricts workflows to an allowlist of actions and harden-runner
+# is not on it. Adding it there would let both workflows in this branch pin
+# their network access.
+#
 # The rebuilt files are committed via the GitHub API (createCommitOnBranch)
 # with a short-lived GitHub App token, never `git push`. API commits are
 # signed server-side by GitHub (Verified), and an App-token commit re-triggers
@@ -46,18 +51,6 @@ jobs:
       contents: read
 
     steps:
-      - name: "Harden runner"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: block
-          disable-sudo: true
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
-            registry.npmjs.org:443
-
       - name: "Checkout Dependabot branch"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with: