Feat: Implement repo and PR check for SHA pinned actions/workflows

[ModeSevenIndustrialSolutions]

Tested here:
https://github.com/ModeSevenIndustrialSolutions/test-gradle-build/actions
On raise of a new PR, runs and checks against just the pull request contents.
Can run on demand with workflow_dispatch, where it checks the entire repository.
Can be set to be mandatory, preventing standard versions pins from being merged.

[tykeal]

Looks good to me.

[ModeSevenIndustrialSolutions]

Tested extensively here:
https://github.com/os-climate/osc-github-devops/actions/runs/12259920677/job/34203261143
Previously, I could not prevent the action from testing all workflows, it was all or nothing. I have had to fetch a list of files changed in the pull request, then rename the file extensions of actions/workflows that are not present in the pull request modified list, effectively excluding them from processing. When invoked using workflow_dispatch, this workflow will still provide feedback on the entire repository, which is useful for evaluating our overall posture.