ci: lint GitHub Actions

[IzumiSy]

Motivation

GitHub Actions workflows and the repository's composite action need automated syntax and security checks before they are merged.

Design Decision

Chosen approach

Use the referenced Aqua-managed toolchain: actionlint for workflow validation, ghalint for GitHub Actions hardening policies, and zizmor for static security analysis. The workflow also checks the root action.yml, which is this repository's composite action metadata.

Trade-offs

Existing workflows now pin third-party actions by commit SHA and declare job-scoped permissions, timeouts, and disabled checkout credentials so the new policies pass without exclusions.

Summary

• Add a path-filtered GitHub Actions lint and security workflow.
• Pin the linter toolchain in aqua.yaml.
• Harden existing workflows and the composite action for the new checks.

[IzumiSy]

@copilot Fix CI errors

[Copilot]

@copilot Fix CI errors

Fixed the zizmor template-injection CI failure in fdc8773 by passing the base ref through an environment variable and shell-quoting it.