fix(action): empty defaults for github-context inputs (composite actions reject expressions in input defaults)

CI failure on PR #74's Action smoke job:

  TemplateValidationException: Unrecognized named-value: 'github'.
  Located at position 1 within expression: github.base_ref / github.token

GitHub composite actions do NOT allow ${{ github.* }} expressions in
input defaults. Only `runs:` step expressions can reference the github
context. Two inputs were affected:

- `audit-base`: now defaults to "". The existing run step already does
  `BASE="${AUDIT_BASE:-$BASE_REF}"` where `BASE_REF: ${{ github.base_ref }}`
  is set as an env var (legal in step env blocks), so empty-input → PR
  base_ref behavior is preserved.
- `token`: now defaults to "". Two call sites (`upload-sarif` step's
  `token:` arg + `pr-comment` step's `GH_TOKEN`) now use
  `${{ inputs.token != '' && inputs.token || github.token }}` to fall
  back to `github.token` when unset.

Both inputs' descriptions updated to document the empty-falls-back
behavior so consumers know what to expect.

Author: SutuSebastian

action.yml

@@ -42,7 +42,7 @@ inputs:
     required: false
     default: ""
   audit-base:
-    description: "Git ref to audit against (when mode=audit). Default: ${{ github.base_ref }} on pull_request events."
+    description: "Git ref to audit against (when mode=audit). Empty (default) → falls back to `github.base_ref` on `pull_request` events; on other events the action no-ops unless an explicit `command:` is set."
     required: false
     default: ""
   changed-since:
@@ -80,9 +80,9 @@ inputs:
     required: false
     default: "any"
   token:
-    description: "GitHub token for SARIF upload + PR comment posting. Default: ${{ github.token }}."
+    description: "GitHub token for SARIF upload + PR comment posting. Empty (default) → falls back to `github.token` automatically. Pass an explicit fine-grained PAT only if you need elevated permissions."
     required: false
-    default: ${{ github.token }}
+    default: ""
 
 outputs:
   agent:
@@ -238,7 +238,7 @@ runs:
       uses: github/codeql-action/upload-sarif@v3
       with:
         sarif_file: ${{ inputs.working-directory }}/${{ inputs.output-path }}
-        token: ${{ inputs.token }}
+        token: ${{ inputs.token != '' && inputs.token || github.token }}
 
     - name: Post PR summary comment
       if: steps.gate.outputs.skip != 'true' && inputs.pr-comment == 'true' && github.event_name == 'pull_request' && always()
@@ -248,7 +248,7 @@ runs:
         EXEC: ${{ steps.detect-pm.outputs.exec }}
         OUTPUT_PATH: ${{ inputs.output-path }}
         PR_NUMBER: ${{ github.event.pull_request.number }}
-        GH_TOKEN: ${{ inputs.token }}
+        GH_TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
       run: |
         # Render the markdown body via `codemap pr-comment`, then post via
         # `gh pr comment`. The same binary that produced the SARIF / JSON