feat(actions): centrally-pinned wrappers for checkout, aws, opentofu

[domengabrovsek]

What

Wraps the third-party actions used most across the personal repos in thin composite actions, each pinning the upstream SHA in one place in this hub. A version bump becomes a single edit here that every repo picks up via @main.

Based on a survey of all 11 personal repos, the most-used third-party actions are: actions/checkout (34), actions/setup-node (9, already wrapped), configure-aws-credentials (8), setup-opentofu (6).

Changes

• New composite wrappers (each SHA-pinned to the latest release):
  • .github/actions/checkout -> actions/checkout v7.0.1
  • .github/actions/aws-credentials -> aws-actions/configure-aws-credentials v6.2.3
  • .github/actions/setup-opentofu -> opentofu/setup-opentofu v2.0.2
• setup-node-npm now consumes the checkout wrapper, so actions/checkout is pinned in exactly one file.
• Dogfooded the wrappers in the hub's own workflows so none carry duplicated raw action SHAs:
  • node-ci.yml: each of the 5 check jobs collapses checkout + setup-node + npm ci into setup-node-npm@main; actionlint job uses the checkout wrapper.
  • security-scan.yml: both jobs use the checkout wrapper.
  • cloudflare-pages-deploy.yml: uses setup-node-npm + aws-credentials wrappers.
• README: documents the wrappers and the central-pinning model.

Behavior notes

• cloudflare-pages-deploy.yml previously ran plain npm ci; via setup-node-npm it now uses the hardened baseline npm ci --ignore-scripts --no-audit --no-fund, matching the rest of the hub.
• The setup-opentofu wrapper pins v2.0.2; consumer repos currently on v1.0.8 / v2 will move to v2.0.2 when they adopt the wrapper.
• Consumer-repo rollout is intentionally not in this PR - the hub lands first, then a pilot repo, then fan-out.

Verification

• actionlint passes clean.
• All composite action.yml files parse as valid YAML.