Feature Request: Improve compatibility with SHA pinning best practices

未指定任何檔案或測試。先追蹤擴充功能現有的內嵌註解與版本升級流程，然後確認 SHA 參照如何對應至已發布的 semver 標籤。針對選定提案實作約定的 SHA-pinning 行為，並在註解與升級的互動中完成驗證，即表示完成。

Is your feature request related to a problem? Please describe.

With recent security escalations around unpinned SHAs and non-immutable release tags, the best practice in many orgs (and the best practice recommended by GitHub) is to hard-pin to SHA releases instead of semver refs.

However, this creates some issues in terms of readability and updates that otherwise would be nicely streamlined by this VS Code extension.

Describe the solution you'd like

1. If the action is pinned to a SHA that is the same as a published semver tag, ideally that semver version would be shown inline in the extension annotation.
2. If the user is pinned to a SHA and they click on the option to upgrade to the latest version, the extension would ideally recognize they are SHA-pinned and give them a SHA-pinned upgrade to that tag, rather than move to only pinning to the semver.
3. If the user is pinned to a semver ref, the UI could give them an option to pin instead to the SHA ref that represents the latest from that semver. This could help users migrate to SHA-pinned references.

(Note: While both proposal 2 and proposal 3 are valuable together, they solve a similar problem. If proposal 3 is delivered, proposal 2 is less needed, and vice versa.)

Additional context

I think these features could go a long way to helping modernize GitHub Actions security, and make it more convenient for people keep their workflows safe (read: "safer") from exploits. Thanks!