Add support to report the versions to the dependency graph API

Right now security vulnerability reporting is broken when a workflow uses a floating tag, branch or sha.

The lock file is a perfect source for the dependency graph to record the dependencies.

The built-in narrowing could also report the actual versions so that de vulnerability reporting works.

I currently have an action that implements this based on parsing the workflows directly:
https://github.com/jessehouwing/actions-dependency-submission

It would be awesome if the "automatic dependency submission" would actually use the existing lock file or generate a ephemeral lockfile.

Start by reviewing the existing automatic dependency submission flow and lockfile generation, then compare the linked actions-dependency-submission implementation. Trace how floating tags, branches, and SHAs are narrowed and how versions reach the dependency graph API. Done means dependencies resolved from an existing or ephemeral lockfile are submitted with actual versions so vulnerability reporting works.

Written by the indexing model from the issue text.