Feature: freshness indicator + one-click bump for outdated uses: action versions

### Summary

The extension already resolves `uses: owner/repo@ref` for validation. It does not surface whether the pinned ref is the latest.

Effect: workflows quietly drift onto EOL action majors (e.g. `actions/checkout@v3` after v4 is default, `actions/upload-artifact@v3` after the v3 sunset). Users only notice on a deprecation warning in a run log, weeks later.

### Proposal

For each `uses:` line:

1. On workflow open, resolve the pinned ref against the action's releases (already an authenticated call the extension can make).
2. If a newer major/minor exists, render a subtle CodeLens above the line: `v3 -> v4 available (published 3 months ago)`.
3. Clicking the CodeLens offers a Quick Fix: rewrite `@v3` to `@v4` (or `@ # v4.1.7` if the current pin is a SHA, preserving the pin style).
4. Results cached per-action for 24h to avoid API-limit churn. Setting: `github-actions.versionCheck.enabled` (default: on) + `github-actions.versionCheck.pinStyle` (`tag` | `sha` | `preserve`, default `preserve`).

### Why this belongs in the extension

Dependabot handles it eventually, but only after a PR round-trip. Renovate/Dependabot are async, this is inline. Same latency benefit as npm-outdated inline hints in the JS ecosystem.

### Non-goals

- Not a security scanner (that is dependabot / `gh actions-secure` territory).
- Not automated PR opening.

### Related

- #592 (autocomplete for action inputs) - same "we already have action metadata loaded" muscle
- #593 (commit-pinned unresolved) - same resolution pipeline

Start by tracing the extension's existing uses: resolution and authenticated action-metadata calls, including the related work in #592 and #593. Define how freshness results, CodeLens, Quick Fix behavior, 24-hour caching, and the github-actions.versionCheck settings fit that pipeline. Done means outdated refs are surfaced inline and can be updated while preserving the configured pin style.

Written by the indexing model from the issue text.