Support version pinning

Currently dist can only generates like `uses: foo/bar@v1`. Pinning it to full-length commit ID is [the recommended way to secure CI](https://docs.github.com/en/actions/reference/security/secure-use?versionId=free-pro-team%40latest&productId=actions&restPage=concepts%2Csecurity#using-third-party-actions). Tools like [Renovate](https://github.com/renovatebot/renovate) provided the pattern `uses: foo/bar@abcdef # v1` to implement it without losing semver. It'll be nice if dist can support that, maybe by ignoring that diff when checking if generated workflow is clear.

Start by locating where cargo-dist generates GitHub Actions workflows and where it checks whether a generated workflow is clear. Trace handling of `uses: foo/bar@v1`, then test the requested full commit ID with a trailing `# v1` comment. Done means version-pinned actions are accepted without losing the semver comment or causing the generated-workflow check to fail.

Written by the indexing model from the issue text.