Supply chain: Actions workflow audit

[martian56]

Audit GitHub Actions usage across repositories.

• Parse workflows and flag unpinned actions, broad permissions, and missing OIDC
• Compute a risk score per workflow
• Endpoint, scan workers, and tests