Lock GitHub Actions dependencies to reviewed commits with workflow lockfiles

Keep GitHub Actions and reusable workflow dependencies on reviewed commits with lockfiles, gradual rollout, stale checks, and clear security limits.