CI: Add workflow to verify workflows

This ensures that we're pinning to hashes on the specified repo, not a
fork.

Author: dopplershift

.github/workflows/verify-pinned-workflows.yml

@@ -0,0 +1,15 @@
+on:
+  pull_request:
+    paths:
+      - '.github/**'
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pinned-actions:
+    name: Verify Pinned Actions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: lesserwhirls/pinned-actions-verifier@ec04596d2fb5dfff128633b505a274a2d48bb298