[Feature]: Support Git commit enumeration for GitHub Actions ecosystem

[Dwdr]

Is your feature request related to a problem? Please describe.

Currently, GitHub Actions advisories in OSV (imported from GHSA) only contain SEMVER or ECOSYSTEM version ranges.

However, security best practices (such as the OpenSSF Scorecard) strongly encourage GitHub Actions workflows to pin actions to immutable Git commit SHAs (e.g., uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b).

Because OSV vulnerability records for GitHub Actions lack GIT ranges, vulnerability scanners querying OSV by commit SHA cannot match these advisories, leading to false negatives where vulnerable actions pinned to commit hashes go undetected.

Describe the solution you'd like

Add support in the worker pipeline for GitHub Actions to generate companion GIT ranges:

1. Parse the action package name into its canonical GitHub repository URL (e.g., actions/checkout -> https://github.com/actions/checkout), supporting nested actions (e.g., docker/build-push-action/v2).
2. Generate companion GIT ranges duplicating the introduced and fixed events.
3. Allow the existing downstream commit enumeration subsystem (affectedcommits.go / Gitter) to traverse the commit DAG, indexing the affected commit hashes and tags into the database.

Describe alternatives you've considered

1. Relying on upstream GHSA records to supply GIT ranges: Upstream GHSA records are community-curated and primarily record release version tags rather than complete commit ranges. Enriching within the OSV worker pipeline bridges this gap automatically for consumers.

Additional context
N/A