Discuss: which GitHub-Actions-security measures should be recommended / encouraged / enforced across ASF repos?

Follow-up to the discussion on #631 (`actions-audit.py`), where @raboof noted we don't yet have consensus on all the checks the tool proposes, and @dave2wave raised the enforcement vs. voluntary-adoption split and the missing input from Security / Infra.

This issue is the place to work toward that consensus. Once we agree, #631 (and any successor in [`apache/infrastructure-gha-workflow-scanner`](https://github.com/apache/infrastructure-gha-workflow-scanner)) can be adjusted to match.

### Classification scheme

For each check, please indicate which tier it belongs to:

- 🟢 **Recommend** — document it, PMCs opt in themselves
- 🟡 **Encourage** — proactively open PRs against PMC repos (with PMC consent upstream on dev@), PMCs can decline
- 🔴 **Enforce** — mandatory baseline, continuously scanned (e.g. via `infrastructure-gha-workflow-scanner`), failure flagged to Infra
- ⚪ **Out of scope** — not appropriate as an ASF-wide policy

### Checks proposed in #631

- [ ] **Dependabot enabled for `github-actions` ecosystem** — tier: ⚪🟢🟡🔴
- [ ] **Dependabot cooldown for `github-actions`** (separate thread in #683 — current proposal: 7 days for "used" actions; 0 days for dependabot PRs that trigger review in this repo) — tier: ⚪🟢🟡🔴, value: 0 / 4 / 7 / other
- [ ] **Dependabot cooldown for language/package ecosystems** (pip, npm, uv, maven, etc.) — tier: ⚪🟢🟡🔴, value: ?
- [ ] **CodeQL scanning for Actions** (`github/codeql-action`) — tier: ⚪🟢🟡🔴
- [ ] **Zizmor workflow scanner** (`zizmorcore/zizmor-action`) — tier: ⚪🟢🟡🔴
- [ ] **ASF allowlist-check** (requires every `uses:` ref to be on the approved list) — tier: ⚪🟢🟡🔴

### Checks proposed elsewhere / worth considering

- [x] **Hash-pinning of all third-party actions** (incl. `actions/*`, `github/*`) — raised in #683 / #703 — tier: ⚪🟢🟡🔴
- [x] **Binary-download verification** in allowed actions (see #686 / #743) — applies to allowlist review, not per-PMC repo scan — n/a here
- [ ] **Minimum-permission workflows** (top-level `permissions: read-all` or equivalent) — tier: ⚪🟢🟡🔴
- [ ] **`persist-credentials: false` on `actions/checkout`** — tier: ⚪🟢🟡🔴

### Meta questions

- [ ] **Where does the tooling live?** → this repo (`infrastructure-actions`) for voluntary / PR-opening; [`apache/infrastructure-gha-workflow-scanner`](https://github.com/apache/infrastructure-gha-workflow-scanner) for continuous enforcement? Or both? (@raboof, @dave2wave)
- [ ] **Scope:** PMC repos (prefix matched), non-PMC repos (`infrastructure-*`, `tooling-*`, `www-site`), or both? (@dave2wave raised scoping)
- [ ] **`.asf.yaml` opt-in/opt-out** — should PMCs be able to configure which checks apply via `.asf.yaml`? (@dave2wave's suggestion)
- [ ] **Decision process:** who has binding input? Proposed: Infra + Security Response team ratify the tiers; PMCs consulted on dev@ before any "🟡 Encourage" PRs are opened.
- [ ] **Rollout:** trial with a small number of friendly PMCs first (announce on their dev@), iterate on PR template, then broaden.

### Related

- #631 — audit tool PR
- #683 — cooldown-period discussion
- #686 — allowlist review criteria
- #703 — hash-pin all third-party actions

cc @raboof @dave2wave @ppkarwasz