GitHub Action to catch unsafe NPM package updates in lockfiles

Thank you to the author of this.

Seems like a good idea.

Please add a license to your repo, though.