ghactions-pin-check: fail CI when a GitHub Action isn't pinned to a SHA

A tiny zero-dependency Go linter that scans .github/workflows, flags any action pinned to a mutable tag or branch instead of a full commit SHA, and exits non-zero so CI blocks the merge. The day's open-source project.