Adopt GitHub Actions Lockfiles

GitHub Actions Lockfiles are now in technical preview:

• https://github.com/github/gh-actions-lock/discussions/3
• https://github.com/cli/cli/issues/13314

The GitHub community design discussion: https://github.com/orgs/community/discussions/194494

It provides true dependency tree pinning akin to package-lock.json. This is better that the previous hash-pinning which only pinned the immediate dependency, but not the nested, transient dependencies.

Renovate has added support for the lockfiles: https://github.com/renovatebot/renovate/pull/45199

From https://github.com/renovatebot/renovate/pull/45199:

gh actions-lock rewrites the workflows it manages back to plain refs
when it regenerates them, which strips out any inline digest pin

Hence, this necessarily replaces: https://github.com/loopbackio/security/issues/27

Workflow

Unlike prior art, this lockfile is used and enforced by GitHub Actions workers themselves without additional action calls.

Usage: https://github.com/github/gh-actions-lock/tree/f41c314f82c2382ef0263c8d93e6d66dce327456

Start with the linked GitHub Actions Lockfiles usage documentation and Renovate pull request, then compare the proposed approach with the previous work in issue 27. Identify which repository workflows are affected; done means the applicable workflows adopt and enforce lockfiles instead of the earlier immediate-dependency hash pinning.