fix: detect unpinned workflow actions

[nyxst4ck]

Summary

• Add a deterministic scanner for newly added uses: entries in .github/workflows/*.yml and .yaml files that reference tags or branches instead of full 40-character commit SHAs.
• Ignore local actions and Docker actions, then merge these findings into the existing audit results before the current filtering pipeline.
• Add focused coverage for workflow parsing, including quoted refs, inline comments, reusable workflows, line-number tracking, and end-to-end audit output behavior.
• Document production guidance for pinning GitHub Actions dependencies to reviewed commit SHAs.

Addresses #112.

Test plan

• python -m pytest claudecode/test_workflow_security.py claudecode/test_main_function.py claudecode/test_github_action_audit.py -q - 35 passed
• python -m ruff check claudecode/workflow_security.py claudecode/github_action_audit.py claudecode/test_workflow_security.py claudecode/test_main_function.py - passed
• python -m py_compile claudecode\workflow_security.py claudecode\github_action_audit.py - passed
• python -m pytest claudecode -q -k "not test_anthropic_api_key_handling and not test_full_workflow_with_real_pr_structure and not test_workflow_with_llm_filtering and not test_workflow_with_no_security_issues and not test_workflow_with_massive_pr and not test_workflow_with_binary_files" - 173 passed, 6 deselected

Attempted full test suite with python -m pytest claudecode -q; the local Windows environment still has existing blockers unrelated to this change: the Claude CLI is not installed for TestEnvironmentSetup.test_anthropic_api_key_handling, and five workflow integration tests fail during TemporaryDirectory cleanup after changing into the temp directory.