Community projects gh-actions-lockfile and ghasum address GitHub’s missing lockfile support with SHA pinning and integrity verification