Feature: freshness indicator + one-click bump for outdated uses: action versions

### Summary

The extension already resolves `uses: owner/repo@ref` for validation. It does not surface whether the pinned ref is the latest.

Effect: workflows quietly drift onto EOL action majors (e.g. `actions/checkout@v3` after v4 is default, `actions/upload-artifact@v3` after the v3 sunset). Users only notice on a deprecation warning in a run log, weeks later.

### Proposal

For each `uses:` line:

1. On workflow open, resolve the pinned ref against the action's releases (already an authenticated call the extension can make).
2. If a newer major/minor exists, render a subtle CodeLens above the line: `v3 -> v4 available (published 3 months ago)`.
3. Clicking the CodeLens offers a Quick Fix: rewrite `@v3` to `@v4` (or `@ # v4.1.7` if the current pin is a SHA, preserving the pin style).
4. Results cached per-action for 24h to avoid API-limit churn. Setting: `github-actions.versionCheck.enabled` (default: on) + `github-actions.versionCheck.pinStyle` (`tag` | `sha` | `preserve`, default `preserve`).

### Why this belongs in the extension

Dependabot handles it eventually, but only after a PR round-trip. Renovate/Dependabot are async, this is inline. Same latency benefit as npm-outdated inline hints in the JS ecosystem.

### Non-goals

- Not a security scanner (that is dependabot / `gh actions-secure` territory).
- Not automated PR opening.

### Related

- #592 (autocomplete for action inputs) - same "we already have action metadata loaded" muscle
- #593 (commit-pinned unresolved) - same resolution pipeline

Comienza rastreando los usos existentes de la extensión: la resolución y las llamadas autenticadas a metadatos de acciones, incluido el trabajo relacionado en #592 y #593. Define cómo encajan en esa canalización los resultados de frescura, CodeLens, el comportamiento de Quick Fix, la caché de 24 horas y la configuración de github-actions.versionCheck. Se considera terminado cuando las refs obsoletas se muestran inline y se pueden actualizar conservando el estilo de pin configurado.

Escrito por el modelo de indexación a partir del texto del issue.