feat: check actions security action

[moe-ad]

Closes #692. Closes #680.

[ansys-reviewer-bot]

Thanks for opening a Pull Request. If you want to perform a review write a comment saying:

@ansys-reviewer-bot review

[SMoraisAnsys]

@SMoraisAnsys to buttress your point, I also can't see what works for us currently wrt the current methods of ignoring things in zizmor. What do you think about parsing the zizmor's output and overriding with a 0 exit code if the ffl are satisfied:

• All raised issues are due to unpinned-uses audit rule &&
• The unpinned-uses issues are due to ansys/actions

Otherwise we might need to request a feature which allows fine-grained ignore rules controls, the maintainer seems very responsive.

I think contacting the maintainer is a better option since it would also benefit other organization implementing their own composite actions. Moreover, in my experience, parsing the output of an app can be a real pain if the output / format changes even just a bit. I know that people in the open source world are more aware of breaking changes but I would avoid it if possible.

[moe-ad]

Feature requested:woodruffw/zizmor#626

Edit: we should also keep track of woodruffw/zizmor#558