Add action pinning linting for actions and reusable workflows

Normalized profile

What this task asks for

Add a configurable lint rule that enforces pinned versions for action and reusable workflow references. Check action and reusable-workflow `uses:` references with the `action-pinning` lint rule. Support `major-minor`, `semver`, and `commit-sha` levels, defaulting to `semver`. Require full 40-character lowercase hexadecimal values at the `commit-sha` level. Skip local and Docker references, but report dynamic version expressions that cannot be verified. Merge allow and deny lists across matching configurations with denials taking precedence. Let per-path configuration and `-action-pinning-level` enable or override only the pinning level.