meta: specify tag when using npx
I don't know if I selected the correct subsystem, so feel free to suggest if I selected the wrong one.
Since we pin Github Actions by commit hash, I think is reasonable to pin npx
packages by version, accords to https://docs.npmjs.com/policies/unpublish is safe to assume those versions will not be changed.
cc @nodejs/security