Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.19.4 to 2.20.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@9af89fc...bf7454d)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

harden-runner v2.20.0 enforces egress blocking on Windows runners for
the first time, which broke the svn choco install (fetched from
sourceforge) and the SVN-based example fetch in the cygwin job.

The previous fix only covered one sourceforge mirror; CI hit a
different one (phoenixnap.dl.sourceforge.net) on retry, since the
mirror sourceforge redirects to varies per run. Switch to a
*.dl.sourceforge.net wildcard to cover any mirror instead of listing
them one by one.

Also add cygwin.com and its default package mirror
(mirrors.kernel.org), which cygwin-install-action needs and which
was never reachable even before harden-runner enforced blocking on
Windows.

Windows hard-fails a WinHTTP download with error 12057
(WINHTTP_ERROR_SECURE_FAILURE) when it can't reach the CA's
certificate revocation endpoint. mirrors.kernel.org's cert chains to
Let's Encrypt, whose CRL responders (x1/x2/ye/ye1.c.lencr.org, seen
rotating across runs) were still being blocked, breaking the cygwin
setup.exe download even though DNS/connect to the mirror itself was
already allowed.

CRL distribution points are conventionally served over plain HTTP
(port 80), never HTTPS, precisely to avoid a circular TLS-validation
dependency (this repo's own macos-latest allowlist already reflects
that convention via ocsp.sectigo.com:80). The previous fix only
opened *.c.lencr.org:443, so the real port-80 CRL fetch for
mirrors.kernel.org's cert was still silently dropped, hanging until
schannel gave up with a generic secure-channel failure (12057) -
same symptom as before despite every relevant domain now resolving
and being allowed on port 443.

The cygwin.com/mirrors.kernel.org fixes let this job progress past
the cygwin install for the first time, surfacing the next missing
endpoint: choco install zig needs ziglang.org, already allowlisted
for the separate windows-latest matrix job but never added here.