Update step-security/harden-runner configuration

[Stephan202]

Suggested commit message:

Update `step-security/harden-runner` configuration (#1271)

While apparently the build doesn't fail without this, it is reasonable
for SonarCloud analysis to access the two additional domains.

While there, introduce subdomain wildcards for `sigstore.dev` and
`sonarcloud.io`.

Example runs that attempted to access these domains:

• To analysis-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
• To api.nuget.org:443

[github-actions]

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

[Stephan202]

I'll add a commit to add some wildcards, based on the feedback in #1246 (comment).

[Stephan202]

Rebased and added two commits: one that introduces wildcards in all "relevant" places, and a second that reverts half of the changes. For some domains one could argue that using a wildcard is too liberal. I think that the current proposal strikes a nice balance between security and maintainability.

[github-actions]

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

[rickie]

*sonarcloud.io:443 would also work if we want to🤔

I didn't saw the update in the other PR, sorry.

[github-actions]

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud