Add the pinGitHubActionDigests helper to improve CI security by using immutable commit SHA digests instead of mutable tags.