Fix: Validate wallet public_key more thoroughly - #758

Bumps the all-actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node), [actions/setup-go](https://github.com/actions/setup-go) and [stellar/stellar-cli](https://github.com/stellar/stellar-cli).

Updates `actions/checkout` from 6.0.3 to 7.0.1

## Release notes

*Sourced from [actions/checkout's releases](https://github.com/actions/checkout/releases).*

> ## v7.0.1
>
> ## What's Changed
>
> * skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2518](https://redirect.github.com/actions/checkout/pull/2518)
> * trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2521](https://redirect.github.com/actions/checkout/pull/2521)
> * escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2530](https://redirect.github.com/actions/checkout/pull/2530)
> * Various dependency updates
>
> **Full Changelog**: actions/checkout@v7...v7.0.1
>
> ## v7.0.0
>
> ## What's Changed
>
> * block checking out fork pr for pull_request_target and workflow_run by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2454](https://redirect.github.com/actions/checkout/pull/2454)
> * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)[bot] in [actions/checkout#2458](https://redirect.github.com/actions/checkout/pull/2458)
> * Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)[bot] in [actions/checkout#2460](https://redirect.github.com/actions/checkout/pull/2460)
> * Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)[bot] in [actions/checkout#2461](https://redirect.github.com/actions/checkout/pull/2461)
> * Bump `@actions/core` and `@actions/tool-cache` and Remove uuid by [@dependabot](https://github.com/dependabot)[bot] in [actions/checkout#2459](https://redirect.github.com/actions/checkout/pull/2459)
> * upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2463](https://redirect.github.com/actions/checkout/pull/2463)
> * Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)[bot] in [actions/checkout#2462](https://redirect.github.com/actions/checkout/pull/2462)
> * getting ready for checkout v7 release by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2464](https://redirect.github.com/actions/checkout/pull/2464)
> * update error wording by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2467](https://redirect.github.com/actions/checkout/pull/2467)
>
> ## New Contributors
>
> * [@aiqiaoy](https://github.com/aiqiaoy) made their first contribution in [actions/checkout#2454](https://redirect.github.com/actions/checkout/pull/2454)
>
> **Full Changelog**: actions/checkout@v6.0.3...v7.0.0
>
> ## v6.1.0
>
> ## What's Changed
>
> * **[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2500](https://redirect.github.com/actions/checkout/pull/2500)
> * backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [actions/checkout#2527](https://redirect.github.com/actions/checkout/pull/2527)
>
> https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
>
> **Full Changelog**: actions/checkout@v6.0.3...v6.1.0

### Commits

* [`3d3c42e`](actions/checkout@3d3c42e) prep v7.0.1 release ([#2531](https://redirect.github.com/actions/checkout/issues/2531))
* [`2880268`](actions/checkout@2880268) escape values passed to --unset ([#2530](https://redirect.github.com/actions/checkout/issues/2530))
* [`12cd223`](actions/checkout@12cd223) trim only ascii whitespace for branch ([#2521](https://redirect.github.com/actions/checkout/issues/2521))
* [`62661c4`](actions/checkout@62661c4) skip running unsafe pr check if input is default ([#2518](https://redirect.github.com/actions/checkout/issues/2518))
* [`e8d4307`](actions/checkout@e8d4307) Bump the minor-actions-dependencies group with 2 updates ([#2499](https://redirect.github.com/actions/checkout/issues/2499))
* [`631c942`](actions/checkout@631c942) eslint 9 ([#2474](https://redirect.github.com/actions/checkout/issues/2474))
* [`4f1f4ae`](actions/checkout@4f1f4ae) Bump actions/upload-artifact from 4 to 7 ([#2476](https://redirect.github.com/actions/checkout/issues/2476))
* [`ba09753`](actions/checkout@ba09753) Bump actions/checkout from 6 to 7 ([#2488](https://redirect.github.com/actions/checkout/issues/2488))
* [`b9e0990`](actions/checkout@b9e0990) Bump docker/login-action from 3.3.0 to 4.2.0 ([#2479](https://redirect.github.com/actions/checkout/issues/2479))
* [`e8cb398`](actions/checkout@e8cb398) Bump docker/build-push-action from 6.5.0 to 7.2.0 ([#2478](https://redirect.github.com/actions/checkout/issues/2478))
* Additional commits viewable in [compare view](actions/checkout@v6.0.3...v7.0.1)

---

Updates `actions/setup-node` from 6.4.0 to 7.0.0

## Release notes

*Sourced from [actions/setup-node's releases](https://github.com/actions/setup-node/releases).*

> ## v7.0.0
>
> ## What's Changed
>
> ### Enhancements:
>
> * Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [actions/setup-node#1577](https://redirect.github.com/actions/setup-node/pull/1577)
> * Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [actions/setup-node#1574](https://redirect.github.com/actions/setup-node/pull/1574)
>
> ### Bug fixes:
>
> * Remove dummy NODE_AUTH_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [actions/setup-node#1558](https://redirect.github.com/actions/setup-node/pull/1558)
> * Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [actions/setup-node#1548](https://redirect.github.com/actions/setup-node/pull/1548)
>
> ### Documentation updates:
>
> * Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [actions/setup-node#1536](https://redirect.github.com/actions/setup-node/pull/1536)
> * docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [actions/setup-node#1550](https://redirect.github.com/actions/setup-node/pull/1550)
> * docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [actions/setup-node#1567](https://redirect.github.com/actions/setup-node/pull/1567)
>
> ### Dependency update:
>
> * Upgrade `@actions/cache` to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [actions/setup-node#1569](https://redirect.github.com/actions/setup-node/pull/1569)
>
> ## New Contributors
>
> * [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [actions/setup-node#1536](https://redirect.github.com/actions/setup-node/pull/1536)
> * [@deiga](https://github.com/deiga) made their first contribution in [actions/setup-node#1548](https://redirect.github.com/actions/setup-node/pull/1548)
> * [@jasongin](https://github.com/jasongin) made their first contribution in [actions/setup-node#1569](https://redirect.github.com/actions/setup-node/pull/1569)
>
> **Full Changelog**: actions/setup-node@v6...v7.0.0
>
> ## v6.5.0
>
> ## What's Changed
>
> * Update `@actions/cache` to 5.1.0 and add security overrides for undici and fast-xml-parser by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [actions/setup-node#1579](https://redirect.github.com/actions/setup-node/pull/1579)
>
> **Full Changelog**: actions/setup-node@v6.4.0...v6.5.0

### Commits

* [`8207627`](actions/setup-node@8207627) Migrate to ESM and upgrade dependencies ([#1574](https://redirect.github.com/actions/setup-node/issues/1574))
* [`04be95c`](actions/setup-node@04be95c) Add cache-primary-key and cache-matched-key as outputs ([#1577](https://redirect.github.com/actions/setup-node/issues/1577))
* [`7c2c68d`](actions/setup-node@7c2c68d) docs: Update caching recommendations to mitigate cache poisoning risks ([#1567](https://redirect.github.com/actions/setup-node/issues/1567))
* [`6a61c03`](actions/setup-node@6a61c03) Merge pull request [#1569](https://redirect.github.com/actions/setup-node/issues/1569) from jasongin/update-actions-cache-5.1.0
* [`30eb73b`](actions/setup-node@30eb73b) Resolve high-severity audit issues
* [`4e1a87a`](actions/setup-node@4e1a87a) Update dist
* [`360237f`](actions/setup-node@360237f) Strict equality
* [`4f8aac5`](actions/setup-node@4f8aac5) Bump `@actions/cache` to 5.1.0, log cache write denied
* [`f4a67bb`](actions/setup-node@f4a67bb) Only use `mirrorToken` in `getManifest` if it's provided ([#1548](https://redirect.github.com/actions/setup-node/issues/1548))
* [`0355742`](actions/setup-node@0355742) Remove dummy NODE_AUTH_TOKEN export ([#1558](https://redirect.github.com/actions/setup-node/issues/1558))
* Additional commits viewable in [compare view](actions/setup-node@v6.4.0...v7)

---

Updates `actions/setup-go` from 6.4.0 to 7.0.0

## Release notes

*Sourced from [actions/setup-go's releases](https://github.com/actions/setup-go/releases).*

> ## v7.0.0
>
> ## What's Changed
>
> * Migrate to ESM and upgrade dependencies by [@priyagupta108](https://github.com/priyagupta108) in [actions/setup-go#763](https://redirect.github.com/actions/setup-go/pull/763)
> * chore(deps): bump `@actions/cache` to 6.2.0 by [@philip-gai](https://github.com/philip-gai) in [actions/setup-go#771](https://redirect.github.com/actions/setup-go/pull/771)
>
> ## New Contributors
>
> * [@philip-gai](https://github.com/philip-gai) made their first contribution in [actions/setup-go#771](https://redirect.github.com/actions/setup-go/pull/771)
>
> **Full Changelog**: actions/setup-go@v6...v7.0.0
>
> ## v6.5.0
>
> ## What's Changed
>
> ### Dependency update
>
> * Upgrade actions dependencies by [@priyagupta108](https://github.com/priyagupta108) with [@Copilot](https://github.com/Copilot) in [actions/setup-go#744](https://redirect.github.com/actions/setup-go/pull/744)
> * Upgrade `@types/node` and typescript-eslint dependencies to resolve npm audit findings by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [actions/setup-go#755](https://redirect.github.com/actions/setup-go/pull/755)
> * Upgrade `@actions/cache` to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [actions/setup-go#758](https://redirect.github.com/actions/setup-go/pull/758)
> * Upgrade version to 6.5.0 in package.json and package-lock.json by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [actions/setup-go#762](https://redirect.github.com/actions/setup-go/pull/762)
>
> ## New Contributors
>
> * [@priyagupta108](https://github.com/priyagupta108) with [@Copilot](https://github.com/Copilot) made their first contribution in [actions/setup-go#744](https://redirect.github.com/actions/setup-go/pull/744)
> * [@jasongin](https://github.com/jasongin) made their first contribution in [actions/setup-go#758](https://redirect.github.com/actions/setup-go/pull/758)
>
> **Full Changelog**: actions/setup-go@v6...v6.5.0

### Commits

* [`b7ad1da`](actions/setup-go@b7ad1da) chore(deps): bump `@actions/cache` to 6.2.0 ([#771](https://redirect.github.com/actions/setup-go/issues/771))
* [`0778a10`](actions/setup-go@0778a10) Migrate to ESM and upgrade dependencies ([#763](https://redirect.github.com/actions/setup-go/issues/763))
* [`924ae3a`](actions/setup-go@924ae3a) chore: bump version to 6.5.0 in package.json and package-lock.json ([#762](https://redirect.github.com/actions/setup-go/issues/762))
* [`e91cc3b`](actions/setup-go@e91cc3b) Bump `@actions/cache` to 5.1.0, log cache write denied ([#758](https://redirect.github.com/actions/setup-go/issues/758))
* [`4a2405e`](actions/setup-go@4a2405e) chore: update `@types/node` and [@typescript-eslint](https://github.com/typescript-eslint) dependencies to latest versi...
* [`78961f6`](actions/setup-go@78961f6) chore: update [@actions](https://github.com/actions) dependencies and refresh license cache ([#744](https://redirect.github.com/actions/setup-go/issues/744))
* See full diff in [compare view](actions/setup-go@v6.4.0...v7)

---

Updates `stellar/stellar-cli` from 27.1.0 to 28.0.0

## Release notes

*Sourced from [stellar/stellar-cli's releases](https://github.com/stellar/stellar-cli/releases).*

> ## 28.0.0
>
> # stellar-cli v28.0.0 — Release Notes
>
> ## 🚀 New Features
>
> * **📦 Build contracts in a container** — `stellar contract build` can now run inside a container, giving you reproducible builds without fussing over your local toolchain. ([#2678](https://redirect.github.com/stellar/stellar-cli/issues/2678))
> * **🤖 AGENTS.md on init** — `stellar contract init` now generates an `AGENTS.md` file so AI coding agents have project context out of the box. ([#2687](https://redirect.github.com/stellar/stellar-cli/issues/2687))
> * **🔗 Protocol 28 support** — the CLI now speaks Protocol 28. ([#2702](https://redirect.github.com/stellar/stellar-cli/issues/2702))
>
> ## 🛠️ Improvements
>
> * **🔍 Better failure diagnostics** — when a transaction fails on-chain, the CLI now surfaces the diagnostic events so you can actually see what went wrong. ([#2700](https://redirect.github.com/stellar/stellar-cli/issues/2700))
>
> ## 🐛 Bug Fixes
>
> * **💸 Fixed `tx simulate` re-assembly** — no longer drops auth entries or double-counts fees. ([#2666](https://redirect.github.com/stellar/stellar-cli/issues/2666))
> * **📁 Fixed manifest path separator** in container builds. ([#2688](https://redirect.github.com/stellar/stellar-cli/issues/2688))
>
> ## 🔒 Security & Hardening
>
> * **🧹 Strip control characters** from auth entry prompts, `contract read` output, and other terminal output — closing off a class of terminal-injection tricks. ([#2667](https://redirect.github.com/stellar/stellar-cli/issues/2667), [#2672](https://redirect.github.com/stellar/stellar-cli/issues/2672), [#2673](https://redirect.github.com/stellar/stellar-cli/issues/2673))
> * **📏 XDR depth limits** — decoding contract spec/meta sections and XDR encoding/decoding now enforce nesting depth limits to guard against malicious or malformed input. ([#2668](https://redirect.github.com/stellar/stellar-cli/issues/2668), [#2675](https://redirect.github.com/stellar/stellar-cli/issues/2675))
>
> ---
>
> ## 🎉 New Contributors
>
> * [@rohansingh4](https://github.com/rohansingh4) made their first contribution in [#2687](https://redirect.github.com/stellar/stellar-cli/issues/2687)
>
> **Full Changelog:** stellar/stellar-cli@v27.1.0...v28.0.0

### Commits

* [`300aaf6`](stellar/stellar-cli@300aaf6) Bump version to 28.0.0 ([#2705](https://redirect.github.com/stellar/stellar-cli/issues/2705))
* [`b8a4865`](stellar/stellar-cli@b8a4865) Find example wasm when target lives at workspace root ([#2704](https://redirect.github.com/stellar/stellar-cli/issues/2704))
* [`b37d549`](stellar/stellar-cli@b37d549) Show diagnostic events when a transaction fails on-chain ([#2700](https://redirect.github.com/stellar/stellar-cli/issues/2700))
* [`ed9a14a`](stellar/stellar-cli@ed9a14a) Add support for Protocol 28 ([#2702](https://redirect.github.com/stellar/stellar-cli/issues/2702))
* [`1e3bc83`](stellar/stellar-cli@1e3bc83) Fix manifest path separator in container build ([#2688](https://redirect.github.com/stellar/stellar-cli/issues/2688))
* [`e89b669`](stellar/stellar-cli@e89b669) Fix security advisories. ([#2690](https://redirect.github.com/stellar/stellar-cli/issues/2690))
* [`80cc0f1`](stellar/stellar-cli@80cc0f1) Generate AGENTS.md when running `stellar contract init` ([#2687](https://redirect.github.com/stellar/stellar-cli/issues/2687))
* [`a29a322`](stellar/stellar-cli@a29a322) Add container support to `stellar contract build` ([#2678](https://redirect.github.com/stellar/stellar-cli/issues/2678))
* [`b8ef49e`](stellar/stellar-cli@b8ef49e) Strip control characters from `contract read` output ([#2672](https://redirect.github.com/stellar/stellar-cli/issues/2672))
* [`965aa47`](stellar/stellar-cli@965aa47) Add depth limit to xdr encoding and decoding ([#2675](https://redirect.github.com/stellar/stellar-cli/issues/2675))
* Additional commits viewable in [compare view](stellar/stellar-cli@v27.1.0...v28.0.0)