Checksums for transitive actions used in composite action

[ericcornelissen]

Summary

Partially address the limitation of unpinnable actions by automatically recording and verifying checksums for the (transitive) actions used by composite actions.

This should have the same effect and work similarly to checksums for actions used in workflows. The effect would be that it catches the use of unpinnable actions within a composite action. However, it would likely be outside the control of the user of ghasum to fix the issue because they likely don't control the unpinnable composite action.