ci: add pinact workflow to auto-pin GitHub Actions

[mocyuto]

Summary

Add a new GitHub Actions workflow (.github/workflows/pinact.yml) that automatically pins third-party Actions used across the repository to specific commit SHAs via pinact.

Why

Relying on mutable tags (e.g. @v4) for third-party GitHub Actions is a supply-chain risk: a compromised tag can inject malicious code into CI. Pinning every action reference to its commit SHA makes the build deterministic and resistant to tag hijacking.

Changes

• Add .github/workflows/pinact.yml:
  • Triggers on PRs that modify .github/workflows/** or any action.yml / action.yaml.
  • Generates a GitHub App installation token via actions/create-github-app-token@v2.2.1 (pinned) so pinact-action can push back fix-up commits / suggestions to the PR branch.
  • Runs suzuki-shunsuke/pinact-action@v3.0.0 (pinned) to update any unpinned action references to their commit SHAs.
  • Concurrency group is scoped per PR with cancel-in-progress: true to avoid stale runs.
  • Restricted to PRs from the same repository via the head.repo.full_name guard.

Required secrets

• APP_ID
• SECRET_KEY

Notes

• This PR is the initial setup; pinact will add commit-level pins to the other workflows (ci.yml, release.yml, tagpr.yml) in follow-up PRs once the workflow runs.
• No production code is touched.