ci: add script to check and update action versions

[ifduyue]

Summary

Add a utility script that checks every uses: reference in .github/workflows/ against the latest stable release of the upstream action, and can rewrite outdated/unpinned references in place.

Usage

python3 .github/scripts/update_actions.py --check            # report only; exit 1 if outdated
python3 .github/scripts/update_actions.py --update           # rewrite files in place
python3 .github/scripts/update_actions.py --update --dry-run # preview changes
python3 .github/scripts/update_actions.py --path <path>      # scan a specific file/dir

Behavior

• Resolves the latest stable vX.Y.Z tag of each action via git ls-remote (no auth needed); annotated tags are resolved to their peeled commit SHA.
• Reports up to date / OUTDATED / UNPINNED / ERROR, skipping docker://, ./, and ../ references.
• Updates follow the repo convention: owner/repo@<full-sha> # vX.Y.Z, preserving indentation and list-item syntax.
• Verified end-to-end against a fixture file (check → dry-run → update → re-check), and against the current workflows (all 21 references up to date).

[codspeed-hq]

Merging this PR will not alter performance

✅ 148 untouched benchmarks
⏩ 66 skipped benchmarks¹

---

_{Comparing ci/update-actions-script (188c81e) with master (cb5ce9f)}

Footnotes

1. 66 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩