add action integrity check in CI with ghasum

[monperrus]

we use all integrity checking mechanisms, esp. when it's ours by @ericcornelissen

https://github.com/ericcornelissen/ghasum/

[ericcornelissen]

Starting to use it should be fairly easy (assuming the tool works), just download the binary and run ghasum init in the root of this project.

Beyond that it's a bit more complicated, the main points being:

• Actually validating the integrity during the workflow. In the project itself I do this by just go running the project (example). That won't work for this (or other) projects. So you'd need to find a suitable way to run ghasum in the workflow. See also ghasum as an Action ghasum#4
• Supporting automatic updates. You use Renovate to automatically update your actions but since Renovate doesn't know about ghasum it won't know to update the gha.sum file. Hence, for the time being, you'd have to update these manually or automatically using a workflow similar to https://github.com/ericcornelissen/ghasum/blob/82d6993e3d1e0787fa1c947b3c77e076cb33de52/.github/workflows/ghasum.yml. See also Support automatic sumfile updating ghasum#9