Add an analyzer for GitHub actions

[sschuberth]

While GitHub actions most likely are not packaged into the distributable and thus probably not relevant for license compliance, they are very relevant for security compliance and vulnerability checks, esp. as GitHub actions have some design flaws.

Thus, an analyzer to determine transitive dependencies of GitHub action in a project repository would be useful, and a subsequent advisor run could be used to detect any known vulnerabilities (probably the github PURL type can be used for this).

As a bonus, the support of GitHub actions would make comparison to GitHub dependency insights (which do support GitHub actions) easier.

[sschuberth]

In the context that "GitHub resolves the commit SHA, finds a matching object, and executes it, regardless of which fork it originated from", such an analyzer could also show warnings if an commit does not resolve from the listed repository.

[sschuberth]

Maybe https://github.com/JulietSecurity/abom could be leveraged here. I'm asking whether it takes the above-mentioned "misbehavior" into account.