fix: do not revoke token if already expired (#147)

Closes #140 

The pull request at #95 introduced changes to avoid revoking expired
tokens by saving the `expiresAt` value in the state. The change,
however, used `core.setOutput` instead of `core.setState` meaning the
value is not saved in the state but rather available in the output.

```javascript
if (!skipTokenRevoke) {
    core.saveState("token", authentication.token);
    core.setOutput("expiresAt", authentication.expiresAt);
  }
```
This means that when we use the value downstream, it evaluates to an
empty string and the following code block is never run:

```javascript
 const expiresAt = core.getState("expiresAt"); 
 if (expiresAt && tokenExpiresIn(expiresAt) < 0) { 
   core.info("Token expired, skipping token revocation"); 
   return; 
 } 
```
This is a tiny PR to correct that typo.

lib/main.js

@@ -104,7 +104,7 @@ export async function main(
   // Make token accessible to post function (so we can invalidate it)
   if (!skipTokenRevoke) {
     core.saveState("token", authentication.token);
-    core.setOutput("expiresAt", authentication.expiresAt);
+    core.saveState("expiresAt", authentication.expiresAt);
   }
 }