Resolve audit warnings (#45)

* Update glob-parent to resolve CVE-2020-28469

* Run audit tasks on Ubuntu runners (they are cheaper)

* Audit only production dependencies

That is, something that can actually affect users of this action.
I don't really want to be bothered with yet another "prototype pollution"
or "denial of service" in transitive dependencies of eslint.

* Audit dev-dependencies for critical vulnerabilities

That said, still audit development dependencies for critical
vulnerabilities if they come along. Hopefully, this should be rare.

.github/workflows/main.yml

@@ -58,12 +58,13 @@ jobs:
           dumpbin /headers hello.exe
   audit:
     name: npm audit
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
     steps:
       - name: Check out source code
         uses: actions/checkout@v2
       - run: npm install
-      - run: npm audit --audit-level=moderate
+      - run: npm audit --audit-level=moderate --production
+      - run: npm audit --audit-level=critical
   alias-arch:
     name: arch aliases
     runs-on: windows-latest