Action-locker: pin, verify, and vendor GHAs

Action-locker is a tool for securing GitHub Actions workflows by pinning actions to specific commit SHAs, verifying their integrity, and vendoring them into the repository. It helps prevent supply chain attacks caused by mutable action tags or compromised third-party actions. The tool is designed for teams that want stricter control over the external actions used in their CI/CD pipelines.