Add GitHub Action to lint incoming GitHub Actions

[wadells]

This workflow will check that all changed and added GitHub actions are either pinned to a hash, or on an allow list. This workflow is built to be reusable across Teleport repos, in addition to enforcing standards in this repo.

I chose to add it here to benefit from shared dorny/paths-filter logic as well as a common allow list of "safe actions".

Contributes to https://github.com/gravitational/security-findings/issues/50

Testing

I tested a version of this workflow in wadells/gha-test. Check out the follow pull request to see it in action:

wadells/gha-test#3

I'll do further testing as we roll this out to different repos. This merge will only affect this repo for the time being.

Notes

teleport and teleport.e are already compliant with this lint config for all supported branches. I plan to add this to all Production-Internal and Production-Public repos (as defined in the GitHub Enterprise RFD). For repos that aren't yet compliant (such as shared-workflows) I'll make sure to fix master before rollout.

zgosalvez/github-actions-ensure-sha-pinned-actions is currently broken (it allows stuff through that it shouldn't). I've got a PR out to fix it:

zgosalvez/github-actions-ensure-sha-pinned-actions#132