ci(security): temporarily use fork of security-action with rsa advisory fix

TEMP verification only: point at fengmk2/security-action@a2a9a4b (head of
oxc-project/security-action#22, which ignores RUSTSEC-2023-0071). Revert to the
upstream oxc-project pin once #22 is merged and released.

Author: fengmk2

.github/workflows/security.yml

@@ -45,4 +45,4 @@ jobs:
         shell: bash
         run: git remote remove origin
 
-      - uses: oxc-project/security-action@cba83d3159bd19731697875c03613fd0fe389f27 # v1.0.7
+      - uses: fengmk2/security-action@a2a9a4b8b7586062d09b26356641915eac2af856 # TEMP: PR oxc-project/security-action#22 (RUSTSEC-2023-0071); revert to oxc-project once merged+released