Use JSON for known checksums (#415)

Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package

src/download/checksum/update-known-checksums.ts

@@ -5,25 +5,16 @@ export async function updateChecksums(
   filePath: string,
   downloadUrls: string[],
 ): Promise<void> {
-  await fs.rm(filePath);
-  await fs.appendFile(
-    filePath,
-    "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n",
-  );
-  let firstLine = true;
+  const checksums: Record<string, string> = {};
   for (const downloadUrl of downloadUrls) {
     const key = getKey(downloadUrl);
     if (key === undefined) {
       continue;
     }
     const checksum = await getOrDownloadChecksum(key, downloadUrl);
-    if (!firstLine) {
-      await fs.appendFile(filePath, ",\n");
-    }
-    await fs.appendFile(filePath, `  "${key}":\n    "${checksum}"`);
-    firstLine = false;
+    checksums[key] = checksum;
   }
-  await fs.appendFile(filePath, ",\n};\n");
+  await fs.writeFile(filePath, `${JSON.stringify(checksums, null, 2)}\n`);
 }
 
 function getKey(downloadUrl: string): string | undefined {