Enable immutable GitHub releases

Description

GitHub releases for the buildx project are currently mutable which is problematic when using the docker/setup-buildx-action as it downloads the buildx binary directly from the buildx GitHub releases^1 and it only allows to pin the buildx version (e.g., v0.33.0) rather than pinning its full length SHA256 digest and doesn't appear to be verifying the integrity of the downloaded file prior to its execution ^2 ^3

While this could be fixed in the action itself, the easiest way may be to enable tag immutability in the settings of the repository (https://github.com/docker/buildx) which would also avoid increasing code complexity in docker/setup-buildx-action actions and any other action or component that download straight from GitHub releases, as well supporting other use-cases that users may have other than just docker/setup-buildx-action.

Could it be possible for https://github.com/docker/buildx to enable tag immutability? Or is it tricky to implement in this project?

Review the requested tag immutability setting for docker/buildx and the linked install.ts and src/main.ts references to understand which downloads depend on mutable releases. Confirm whether repository settings can enforce immutable tags and whether enabling them affects the cited release consumers; done means the setting is enabled or the blocker is documented.