ci: fix GitHub Actions workflow to use only trusted actions

Replace shogo82148/actions-setup-perl@v1 with manual Perl setup to comply
with organization security policy that requires actions to be from GitHub,
verified marketplace, or torrust-owned repositories.

- Use system Perl instead of third-party setup action
- Install cpanminus, local::lib, and Carmel manually
- Maintain same functionality while meeting security requirements

Author: josecelano

.github/workflows/testing.yml

@@ -31,26 +31,31 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Perl
-        uses: shogo82148/actions-setup-perl@v1
-        with:
-          perl-version: "5.20"
-
-      - name: Install cpanminus and Carmel
+      - name: Install Perl and dependencies
         run: |
+          # Ubuntu already has Perl 5.34+ installed
+          perl -v
+
+          # Install cpanminus to ~/perl5/bin
           curl -L https://cpanmin.us | perl - App::cpanminus
+
+          # Add perl5/bin to PATH for this step and subsequent ones
+          export PATH="$HOME/perl5/bin:$PATH"
+          echo "$HOME/perl5/bin" >> $GITHUB_PATH
+
+          # Setup local::lib
           cpanm --local-lib=~/perl5 local::lib
           eval $(perl -I ~/perl5/lib/perl5/ -Mlocal::lib)
+
+          # Install Carmel
           cpanm Carmel
 
       - name: Install project dependencies
         run: |
           eval $(perl -I ~/perl5/lib/perl5/ -Mlocal::lib)
-          export PATH="$HOME/perl5/bin:$PATH"
           carmel install
 
       - name: Run tests
         run: |
           eval $(perl -I ~/perl5/lib/perl5/ -Mlocal::lib)
-          export PATH="$HOME/perl5/bin:$PATH"
           carmel exec -- prove -l t/