Add a CI workflow that checks whether used GitHub Actions are allowed

[kou]

We can prevent merging PRs that upgrade to not allowed GitHub Actions by this check.

For example: #63 upgrades erlef/setup-beam to 1.24.1 but 1.24.1 isn't allowed for now. Because erlef/setup-bean has a security concern discussed in apache/infrastructure-actions#751 (see also: erlef/setup-beam#456 ). 1.24.1 still has the concern. So it's not allowed for now.