[Backport 2.19] Bump 1password/load-secrets-action to v5.0.1 (performance-analyzer)

[peterzhuamazon]

Backport of #972 to 2.19. The auto-backport failed (cherry-pick conflict), so this was recreated manually to the desired end state.

Relates to opensearch-project/opensearch-build#6440 (comment)

Signed-off-by: Peter Zhu zhujiaxi@amazon.com

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 1b75577.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
.github/workflows/maven-publish.yml	26	high	GitHub Actions dependency change: 1password/load-secrets-action updated from pinned commit 2ebe1bc (v2) to 70062d7 (v5.0.1). This is a major version jump (v2 → v5) for an action with direct access to secrets. The new commit hash must be independently verified against the official 1password/load-secrets-action repository to confirm it corresponds to the claimed v5.0.1 tag and has not been tampered with. A compromised version of this action could silently exfiltrate all secrets it loads.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected