Bump step-security/harden-runner from 2.5.1 to 2.6.0 (#13484)

Bump step-security/harden-runner from 2.5.1 to 2.6.0 (#13484) #888