Follow GitHub Actions best practices

[swissspidy]

Some pointers in #53.

• Use step outputs
• Remove those #------------------------------------ comments
• Set permissions
• Follow best practices such as https://docs.github.com/en/actions/reference/security/secure-use