Implement `actions audit` workflow scanner

[ralyodio]

Add actions audit command to sh1pt CLI. This workflow audit should detect risky patterns in .github/workflows/ such as:

• uses: action@main or @master
• permissions: write-all or missing permissions
• Untrusted third-party actions
• Unsafe triggers (e.g., pull_request_target)
• Unpinned Docker images
• Secrets exposure
• Excessive token permissions
• curl | bash or wget | bash usage

Results should be human-readable and, if possible, support a --json flag for machine output.

Reference: #422