Bump @vercel/ncc -> 0.38.1 and @actions/core -> 1.10.1

[graebm]

Issue:
Dependabot wants to bump these npm dependencies. See:
#252
#253
#258
#259

But Github actions are weird and you need to run npm install and commit the artifacts after an npm update. So here's my own manual PR.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[bretambrose]

Can we configure this to not get minor/patch PRs that aren't about security issues? This is kind of silly.

[graebm]

I don't see an option like that: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

I think it's supposed to be a painless thing where you just merge the PRs it puts up. These ones are weird thought because you're supposed to commit the build artifacts for Github Actions, and dependabot only does npm update it doesn't do npm install