Bump step-security/harden-runner from 2.17.0 to 2.19.0 (#1682)

Bumps
[step-security/harden-runner](https://github.com/step-security/harden-runner)
from 2.17.0 to 2.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.19.0</h2>
<h2>What's Changed</h2>
<h3>New Runner Support</h3>
<p>Harden-Runner now supports Depot, Blacksmith, Namespace, and
WarpBuild runners with the same egress monitoring, runtime monitoring,
and policy enforcement available on GitHub-hosted runners.</p>
<h3>Automated Incident Response for Supply Chain Attacks</h3>
<ul>
<li>Global block list: Outbound connections to known malicious domains
and IPs are now blocked even in audit mode.</li>
<li>System-defined detection rules: Harden-Runner will trigger lockdown
mode when a high risk event is detected during an active supply chain
attack (for example, a process reading the memory of the runner worker
process, a common technique for stealing GitHub Actions secrets).</li>
</ul>
<h3>Bug Fixes</h3>
<p>Windows and macOS: stability and reliability fixes</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.18.0...v2.19.0">https://github.com/step-security/harden-runner/compare/v2.18.0...v2.19.0</a></p>
<h2>v2.18.0</h2>
<h2>What's Changed</h2>
<p>Global Block List: During supply chain incidents like the recent
axios and trivy compromises, StepSecurity will add known malicious
domains and IP addresses (IOCs) to a global block list. These will be
automatically blocked, even in audit mode, providing immediate
protection without requiring any workflow changes.</p>
<p>Deploy on Self-Hosted VM: Added <code>deploy-on-self-hosted-vm</code>
input that allows the Harden Runner agent to be installed directly on
ephemeral self-hosted Linux runner VMs at workflow runtime. This is
intended as an alternative when baking the agent into the VM image is
not possible.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.17.0...v2.18.0">https://github.com/step-security/harden-runner/compare/v2.17.0...v2.18.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/step-security/harden-runner/commit/8d3c67de8e2fe68ef647c8db1e6a09f647780f40"><code>8d3c67d</code></a>
Release v2.19.0 (<a
href="https://redirect.github.com/step-security/harden-runner/issues/661">#661</a>)</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/6c3c2f2c1c457b00c10c4848d6f5491db3b629df"><code>6c3c2f2</code></a>
Feature/deploy on self hosted vm (<a
href="https://redirect.github.com/step-security/harden-runner/issues/658">#658</a>)</li>
<li>See full diff in <a
href="https://github.com/step-security/harden-runner/compare/f808768d1510423e83855289c910610ca9b43176...8d3c67de8e2fe68ef647c8db1e6a09f647780f40">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=step-security/harden-runner&package-manager=github_actions&previous-version=2.17.0&new-version=2.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/push_gem.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit