Add freebsd-vm action into allowlist

[PragmaTwice]

Request for adding a new GitHub Action to the allow list

Overview

Name of action: vmactions/freebsd-vm

URL of action: https://github.com/vmactions/freebsd-vm

Version to pin to (hash only):

05856381fab64eeee9b038a0818f6cec649ca17a

vmactions/freebsd-vm@0585638

Permissions

None.

Related Actions

None.

Checklist

You should be able to check most of these boxes for an action to be considered for review.
Please check all boxes that currently apply:

• The action is listed in the GitHub Actions Marketplace
• The action is not already on the list of approved actions
• The action has a sufficient number of contributors or has contributors within the ASF community
• The action has a clearly defined license
• The action is actively developed or maintained
• The action has CI/unit tests configured

[assignUser]

The tag matches.

My problem with this Action is that it appears like the entire 'vmactions' org is maintained by a single person with some additional contributions in select repos. That doesn't really fit our criteria. But I also see that this action is without any real alternatives and actively maintained.

@PragmaTwice I will not allow list this action with the workflow in the current state. Minimize permissions of the GITHUB_TOKEN of the job using: (this should be the default for ALL jobs)

permissions:
  contents: read

[PragmaTwice]

I will not allow list this action with the workflow in the current state. Minimize permissions of the GITHUB_TOKEN of the job using: (this should be the default for ALL jobs)

Done in apache/kvrocks@a5ca028.

[raboof]

I will not allow list this action with the workflow in the current state. Minimize permissions of the GITHUB_TOKEN of the job using: (this should be the default for ALL jobs)

Done in apache/kvrocks@a5ca028.

It seems that commit doesn't (or no longer) appears in the kvrocks repository. Is this action still needed?

[PragmaTwice]

The PR author closed the PR without next steps. apache/kvrocks#3141