feat(pipeline): Support GitHub Actions commit enumeration - #6012

Overview

Adds automated Git commit enumeration support for the GitHub Actions ecosystem within the OSV worker pipeline (go/internal/worker/pipeline/githubactions/).

Fixes #6013

Details

Currently, GitHub Actions advisories imported into OSV only specify SEMVER or ECOSYSTEM version ranges. When workflows pin actions to immutable Git commit SHAs (as recommended by OpenSSF Scorecard), vulnerability scanners querying OSV by commit SHA cannot match these advisories.

This pull request implements:

1. Repository Extraction (ExtractGitHubRepoURL): Parses GitHub Action package identifiers into their canonical repository URLs (https://github.com/<owner>/<repo>), gracefully handling nested sub-action directories (e.g., docker/build-push-action/v2), leading slashes, .git suffixes, and directory traversal (..) attempts.
2. Pipeline Enricher (githubactions.Enricher): Inspects vulnerability records affecting the GitHub Actions ecosystem. For each affected package, it extracts the repository URL and injects companion Range_GIT ranges duplicating the version events (introduced / fixed / last_affected).
3. Downstream Gitter Activation: Because OSV's worker engine already inspects Range_GIT ranges and queries the Gitter service, injecting companion Range_GIT ranges automatically enumerates intermediate commits and tags into affected.versions with zero changes required to Gitter or the core engine.
4. Idempotency & Safety: Duplicate runs of Enrich do not duplicate existing Range_GIT entries, and events are deep-copied to prevent shared pointer mutation.
5. Registry Integration: Registers &githubactions.Enricher{} in internal/worker/pipeline/registry/registry.go.

Testing

• Added 25 table-driven unit tests in go/internal/worker/pipeline/githubactions/githubactions_test.go covering URL canonicalization, sub-action normalization, malicious path handling, SEMVER/ECOSYSTEM range companion generation, non-GitHub Actions filtering, and idempotency.
• Ran all unit tests concurrently with the Go data race detector:
  go test -race -v ./internal/worker/pipeline/githubactions/... (100% PASS).
• Verified code formatting and vetting:
  gofmt -s -d (0 diffs).
  go vet ./internal/worker/pipeline/githubactions/... (0 warnings).
• Cleaned up all linter checks (stringscutprefix, nlreturn, and protogetter protobuf accessor compliance).