Use JSON for known checksums (#415)

Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package

__tests__/download/checksum/update-known-checksums.test.ts

@@ -0,0 +1,38 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { expect, jest, test } from "@jest/globals";
+
+const mockDownloadTool = jest.fn<() => Promise<string>>();
+
+jest.unstable_mockModule("@actions/tool-cache", () => ({
+  downloadTool: mockDownloadTool,
+}));
+
+const { updateChecksums } = await import(
+  "../../../src/download/checksum/update-known-checksums"
+);
+
+test("serializes checksum entries as JSON data", async () => {
+  const tempDirectory = await fs.mkdtemp(
+    path.join(os.tmpdir(), "ruff-action-checksums-test-"),
+  );
+  const checksumPath = path.join(tempDirectory, "checksum");
+  const outputPath = path.join(tempDirectory, "known-checksums.json");
+  const checksum = 'checksum"\\value';
+  const platform = 'platform"\n};\ncompromised = true;';
+  const downloadUrl = `https://example.com/v1.0.0/ruff-1.0.0-${platform}.tar.gz.sha256`;
+
+  try {
+    await fs.writeFile(checksumPath, `${checksum}  ruff.tar.gz`);
+    mockDownloadTool.mockResolvedValue(checksumPath);
+
+    await updateChecksums(outputPath, [downloadUrl]);
+
+    const content = await fs.readFile(outputPath, "utf8");
+    expect(JSON.parse(content)).toEqual({ [`${platform}-1.0.0`]: checksum });
+    expect(content.endsWith("\n")).toBe(true);
+  } finally {
+    await fs.rm(tempDirectory, { force: true, recursive: true });
+  }
+});