Determine some more criteria for actions review

Following the discussion in https://github.com/apache/infrastructure-actions/pull/674#issuecomment-4216174449

Possible criteria:

- [x] Reproducibility — implemented in #561, #614, #629, #652, #674, #675, #734
- [x] Code review of differences vs. past approved version — implemented in #647, #671
- [x] Passing cooldown (now 0 days) — implemented in #560, #712, #737
- [x] Correctness of the action (for example errors in build pipelines) — ongoing fixes in #617, #628, #664, #685, #733, #734
- [x] Hash-pinning of composite actions — implemented in #629 (supporting fixes: #619, #620)
- [x] Checking if downloaded binaries are verified — pending in #743
- [ ] Reject actions that ship pre-compiled native binaries (Go, Rust, C, etc.) in-tree without verifiable build provenance.
- [ ] Compatible licencing

Goal not criteria:

- [ ] Reject actions with suspicious builds, e.g. those that use different dependencies than what the source implies (proposed by @dave2wave) — partially addressed by verify-action-build warnings

Rejected:

~- [ ] Attestations~

Maybe others?

I would love to hear what others think.