GitHub says modern supply-chain attacks increasingly start with secret exfiltration from GitHub Actions, not just poisoned packages further downstream.