Issue Description

The Update-ActionSHAPinning.ps1 script has thin test coverage at 222 lines. This security-related script manages SHA pinning for GitHub Actions and warrants comprehensive unit tests to ensure reliability.

Current state:

• Test file: scripts/tests/security/Update-ActionSHAPinning.Tests.ps1 (222 lines)
• Coverage target: 80%

Suggested test areas:

• Parameter validation (action patterns, dry-run mode)
• SHA resolution and update logic
• File discovery and filtering
• Error handling for API failures
• Output formatting and reporting

Additional Context

This follows the test coverage improvement pattern established in:

• [Issue]: Add Pester tests for Invoke-VerifiedDownload orchestration function #264 (Get-VerifiedDownload.ps1)
• test(scripts): add Pester tests for Invoke-YamlLint.ps1 #326 (Invoke-YamlLint.ps1)

Reference the existing test patterns in scripts/tests/ for mocking strategies and Pester 5.x conventions.