mandate action-setup-artifactory use

There is a high risk that workflows which should use this action do not.

Perhaps because:

• The developers are not aware of this action.
• The developers forget to use it in any particular workflow.
• The developers are not aware that they are downloading dependencies (e.g, building pip packages causes implicit installs).
• The packages are installed via another action - i.e, a whitelisted action (e.g, setup-micromamba).

From a cursory skim there are definitely a few workflows in the MetOffice organisation which fall into these categories :(

If #15 is undertaken, then this action could be used with zero-configuration.

That opens the door to making this action a site-default, ensuring it is set up for all workflows (the best security policy is one which doesn't need to be written down!).

Exactly how this would be implemented I'm not entirely sure. There might be some fancy way to configure this at the job level (e.g, setting the default shell?).

But if not, a fallback approach which seems viable would be to create a "Required Workflow" (which would be added to all MetOffice projects) which could then "lint" GitHub actions, and, say, raise a friendly PR adding this action to any which do not use it:

https://github.blog/enterprise-software/devops/introducing-required-workflows-and-configuration-variables-to-github-actions/#required-workflows

Start by reviewing the existing action configuration and the GitHub Actions workflows in the MetOffice organisation. Compare required workflows, job-level defaults, and linting or automated pull-request approaches. Done means workflows that should use action-setup-artifactory are reliably identified and guided or updated without requiring each developer to remember the policy.