fix: warning about GHA security (#189)

We can instead use dependabot.yml to keep actions up via PRs every day or week when new changes are detected. In that case, we'd use v2.0.0 here.

.github/workflows/build-test.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: "actions/checkout@v2"
 
       - name: "Get conda"
-        uses: "conda-incubator/setup-miniconda@v1"
+        uses: "conda-incubator/setup-miniconda@v2"
         with:
           auto-update-conda: true
           python-version: ${{ matrix.python-version }}