ci: pin actions to SHA for supply-chain security

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: DUBSOpenHub

.github/workflows/validate.yml

@@ -14,7 +14,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
 
       - name: Check SKILL.md files are in sync
         run: |