Feature: freshness indicator + one-click bump for outdated uses: action versions

### Summary

The extension already resolves `uses: owner/repo@ref` for validation. It does not surface whether the pinned ref is the latest.

Effect: workflows quietly drift onto EOL action majors (e.g. `actions/checkout@v3` after v4 is default, `actions/upload-artifact@v3` after the v3 sunset). Users only notice on a deprecation warning in a run log, weeks later.

### Proposal

For each `uses:` line:

1. On workflow open, resolve the pinned ref against the action's releases (already an authenticated call the extension can make).
2. If a newer major/minor exists, render a subtle CodeLens above the line: `v3 -> v4 available (published 3 months ago)`.
3. Clicking the CodeLens offers a Quick Fix: rewrite `@v3` to `@v4` (or `@ # v4.1.7` if the current pin is a SHA, preserving the pin style).
4. Results cached per-action for 24h to avoid API-limit churn. Setting: `github-actions.versionCheck.enabled` (default: on) + `github-actions.versionCheck.pinStyle` (`tag` | `sha` | `preserve`, default `preserve`).

### Why this belongs in the extension

Dependabot handles it eventually, but only after a PR round-trip. Renovate/Dependabot are async, this is inline. Same latency benefit as npm-outdated inline hints in the JS ecosystem.

### Non-goals

- Not a security scanner (that is dependabot / `gh actions-secure` territory).
- Not automated PR opening.

### Related

- #592 (autocomplete for action inputs) - same "we already have action metadata loaded" muscle
- #593 (commit-pinned unresolved) - same resolution pipeline

Commencez par retracer les utilisations existantes de l’extension : la résolution et les appels authentifiés aux métadonnées des actions, y compris le travail associé dans #592 et #593. Définissez comment les résultats de fraîcheur, CodeLens, le comportement de Quick Fix, la mise en cache pendant 24 heures et les paramètres de github-actions.versionCheck s’intègrent dans ce pipeline. Le travail est terminé lorsque les refs obsolètes sont signalées inline et peuvent être mises à jour tout en préservant le style de pin configuré.

Rédigé par le modèle d'indexation à partir du texte de l'issue.