Feature Request: Improve compatibility with SHA pinning best practices

**Is your feature request related to a problem? Please describe.**

With recent security escalations around unpinned SHAs and non-immutable release tags, the best practice in many orgs (and the best practice recommended by GitHub) is to hard-pin to SHA releases instead of semver refs.

However, this creates some issues in terms of readability and updates that otherwise would be nicely streamlined by this VS Code extension.

**Describe the solution you'd like**

1. If the action is pinned to a SHA that is the same as a published semver tag, ideally that semver version would be shown inline in the extension annotation.
2. If the user is pinned to a SHA and they click on the option to upgrade to the latest version, the extension would ideally recognize they are SHA-pinned and give them a SHA-pinned upgrade to that tag, rather than move to _only_ pinning to the semver.
3. If the user is pinned to a semver ref, the UI could give them an option to pin instead to the SHA ref that represents the latest from that semver. This could help users migrate to SHA-pinned references.

_(Note: While both proposal 2 and proposal 3 are valuable together, they solve a similar problem. If proposal 3 is delivered, proposal 2 is less needed, and vice versa.)_

**Additional context**

I think these features could go a long way to helping modernize GitHub Actions security, and make it more convenient for people keep their workflows safe (read: "safer") from exploits. Thanks!

No files or tests are named. Start by tracing the extension's existing inline annotation and version-upgrade flows, then determine how SHA references map to published semver tags. Done means the agreed SHA-pinning behavior is implemented for the selected proposals and verified across annotation and upgrade interactions.

Escrito por el modelo de indexación a partir del texto del issue.