Lock GitHub Actions dependencies to reviewed commits with workflow lockfiles

A moving tag is not a review Your workflow can keep saying uses: vendor/build-action@v3 while the code behind v3 changes. That leaves a gap between the commit your team reviewed and the commit a later