feat: add SHA pinning validation for reusable workflow references

[TAJeffcock]

what

• Adds a validation step to github-workflow-validation.yml that fails if any reusable workflow reference to appvia/appvia-cicd-workflows uses a tag or branch instead of a full commit SHA
• Adds scripts/audit_sha_pinning.sh to discover non-compliant terraform-aws-* repositories across an org

why

• Reusable workflow references pinned to tags or branches are mutable — a tag move or force-push could silently change what executes without review
• This guardrail prevents regression by blocking PRs that introduce non-SHA references going forward
• Part of supply-chain security standardisation across terraform-aws-* repositories (SA-689)

references

• SA-689