Add Cycode's GitHub Actions Vulnerabilities example

[david-a-wheeler]

Add, as an example, the vulnerability described by Cycode in "How We Discovered Vulnerabilities in CI/CD Pipelines of Popular Open-Source Projects" by Alex Ilgayev (Cycode), 2022-03-18 and explained at their talk at SupplyChainSecurityCon 2022.

This could be explained as part of the shell injection section. However, maybe this should go into an expanded section on build systems & supply chains, since it's a kind of attack that many developers hadn't considered.