Do not echo `stop-commands` command

[ylemkimon]

Describe the enhancement
It is recommended to disable command processing via stop-commands when logging untrusted information in https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/. However, the token used to stop commands is echoed and visible in logs.

If the logged information is dynamic, i.e., can be changed after the token is printed to the log, it can re-enable workflow commands.

[rcowsill]

To avoid this issue you can add a mask for the resume token:

jobs:
  example-job:
    name: example
    runs-on: ubuntu-latest
    steps:
    - name: log untrusted output
      run: |
        # Generate a unique resume token for this workflow run
        COMMAND_RESUME_TOKEN=$(echo -n ${{ github.token }} | sha256sum | head -c 64)

        # Mask the resume token's value in the logs
        echo "::add-mask::$COMMAND_RESUME_TOKEN"

        # Stop command workflow processing
        echo "::stop-commands::$COMMAND_RESUME_TOKEN"

        # Log untrusted output
        echo "::notice::Untrusted output"

        # Resume workflow command processing
        echo "::$COMMAND_RESUME_TOKEN::"

        # Log trusted output
        echo "::notice::Trusted output"

This masks the resume token where it's used in the stop-commands workflow command. It also masks it in the debug output produced by the runner when ACTIONS_STEP_DEBUG is set to true.

[assignUser]

It looks like the value is masked automatically now; 👍

[ylemkimon]

Fixed via #1371.