Extend `actions/unpinned-tag` to analyze composite action metadata (`action.yml` / `action.yaml`) #37655