Linting for GitHub actions

:clipboard: **Description**

Follow up from https://github.com/badges/shields/pull/9542

We make extensive use of GitHub actions and workflows. They're a huge productivity boost.

Simultaneously, there are some foot guns and security considerations. https://github.com/badges/shields/pull/9542 highlights one of these.

This was an issue I was previously aware of https://github.com/badges/shields/blob/1d9a6b0f80b3c3a958f02ebedae60840020ba991/.github/actions/service-tests/action.yml#L47-L57 but I missed it in the review of https://github.com/badges/shields/pull/9386

Can we adopt some automated tooling that would flag issues like this and help us to fall into the pit of success here? One option is https://github.com/rhysd/actionlint I've not tried it out yet but it looks like this would have caught that issue in CI.
Are there other options we should evaluate?

Start by reviewing the referenced .github/actions/service-tests/action.yml lines 47-57 and the follow-up from pull request 9542. Evaluate actionlint and other options for the repository's GitHub Actions workflows; the work is done when an agreed automated check flags the cited class of issue in CI.

Written by the indexing model from the issue text.