Github Actions(deps): Bump lowlighter/metrics from 3.25 to 3.26

[dependabot]

Bumps lowlighter/metrics from 3.25 to 3.26.

Release notes

Sourced from lowlighter/metrics's releases.

Version 3.26

ℹ️ This release is mostly focused on Web instances. If you only use metrics through GitHub Actions, you can ignore this version.

🎉 Thanks to all my sponsors, metrics.lecoq.io has been migrated on a more powerful server and should be able to handle more requests!

📦 New features

• 🌐 Web instances
  • Home page has been redesigned to better guide users through the different features of metrics
    • 📊 Metrics embed is now accessible through /embed/
      • Action and markdown tabs can now be displayed without entering an username
    • ✨ Metrics insights is now accessible through /insights/
    • Backwards compatibility with previous endpoints has been kept
      • /:login and /:login/:repository will still generate embed metrics
      • /about/ will redirect towards /insights/
  • Add support for new options in settings.json
    • outputs can be used to restrict which output formats can be used with config.output
    • modes can be used to separately enable or disable embed and insights modes
    • control.token can be used to configure a token which can be used by external services to perform action on instance
      • /.control/stop can be used to stop instance (useful to redeploy or restart it)
    • Add more granularity to extras.features to enable advanced plugin features
      • The following permissions are currently supported:
        • metrics.setup.community.templates: Allow community templates download
        • metrics.setup.community.presets: Allow community presets usage
        • metrics.api.github.overuse: Allow GitHub API intensive requests
        • metrics.cpu.overuse: Allow CPU intensive requests
        • metrics.run.tempdir: Allow access to temporary directory (including I/O)
        • metrics.run.git: Allow to run git
        • metrics.run.licensed: Allow to run licensed
        • metrics.run.user.cmd: Allow to run ANY command by user (USE WITH CAUTION! May result in token leaks by malicious users)
        • metrics.run.puppeteer.scrapping: Allow to run puppeteer to scrape data
        • metrics.run.puppeteer.user.css: Allow to run CSS by user during puppeteer render
        • metrics.run.puppeteer.user.js: Allow to run JavaScript by user during puppeteer render
        • metrics.npm.optional.chartist: Allow use of chartist
        • metrics.npm.optional.gifencoder: Allow use of gifencoder
        • metrics.npm.optional.libxmljs2: Allow use of libxmljs2

      • ⚠️ If you deployed a web server with a previous version, you may need to reconfigure extras.features with some of the permissions listed above to keep some plugins working

      • The following settings has been deprecated:
        • extras.presets should now use extras.features with metrics.setup.community.presets
        • extras.js should now use extras.features with metrics.run.puppeteer.user.js
        • extras.css should now use extras.features with metrics.run.puppeteer.user.css
    • Settings display on startup has been improved

🧰 Fixes and documentation

• fix(app/web): force faker to be uncached for users who used a previous version of web instance
• fix(deps): libxmljs2 is now an optional dependency

... (truncated)

Commits

• 26bbaac Release v3.26 [release]
• 6b10a6d ci: auto-regenerate files
• f2ff835 chore: prepare release v3.26 (#1127) [skip ci]
• 48b5a2c fix(ci): repository examples after test examples [skip ci]
• 906bafa ci: auto-regenerate files
• 4fc7372 fix(ci): repository examples after test examples
• cfbbbf0 fix(ci): label
• 4f60759 fix(app/action): community templates
• affdca0 fix(app/web): extras features handling
• 7564b81 docs(app/web): update
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)