Adopt GitHub Actions Lockfiles

GitHub Actions Lockfiles are now in technical preview:

• https://github.com/github/gh-actions-lock/discussions/3
• https://github.com/cli/cli/issues/13314

The GitHub community design discussion: https://github.com/orgs/community/discussions/194494

It provides true dependency tree pinning akin to package-lock.json. This is better that the previous hash-pinning which only pinned the immediate dependency, but not the nested, transient dependencies.

Renovate has added support for the lockfiles: https://github.com/renovatebot/renovate/pull/45199

From https://github.com/renovatebot/renovate/pull/45199:

gh actions-lock rewrites the workflows it manages back to plain refs
when it regenerates them, which strips out any inline digest pin

Hence, this necessarily replaces: https://github.com/loopbackio/security/issues/27

Workflow

Unlike prior art, this lockfile is used and enforced by GitHub Actions workers themselves without additional action calls.

Usage: https://github.com/github/gh-actions-lock/tree/f41c314f82c2382ef0263c8d93e6d66dce327456

Beginne mit der verlinkten Dokumentation zur Verwendung von GitHub Actions Lockfiles und dem Renovate-Pull-Request und vergleiche anschließend den vorgeschlagenen Ansatz mit den bisherigen Arbeiten in issue 27. Ermittle, welche Repository-Workflows betroffen sind; abgeschlossen bedeutet, dass die zutreffenden Workflows Lockfiles anstelle des früheren Hash-Pinnings unmittelbarer Abhängigkeiten übernehmen und durchsetzen.