docs: add content about action commit SHA pinning to docs

[brynary]

No description provided.

[qltysh]

Diff Coverage: Not applicable. There was no coverage data reported for the files in this diff.

Total Coverage: This PR will not change total coverage.

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[qltysh]

❌ 2 blocking issues (8 total)

Tool	Category	Rule	Count
prettier	Style	Incorrect formatting, autoformat by running qlty fmt.	4	❌
markdownlint	Style	Fenced code blocks should be surrounded by blank lines	4

@qltysh one-click actions:

• Auto-fix formatting (qlty fmt && git push)

[Copilot]

Pull request overview

This PR adds documentation about pinning GitHub Actions to specific commit SHAs for enhanced security. The tip boxes direct users to GitHub's official security hardening documentation and provide example syntax for SHA-based pinning.

Key changes:

• Added security tip boxes to both the main README and coverage-specific README
• Included example YAML syntax showing how to pin actions to commit SHAs

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
coverage/README.md	Added TIP callout box with SHA pinning guidance in the Quick Start section
README.md	Added TIP callout box with SHA pinning guidance after the actions table

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

[nitpick] The example specifically shows the /coverage action, but the tip applies to all three actions listed in the table above (coverage, install, and fmt). Consider using a more generic example like qltysh/qlty-action/<action>@a1b2c3d4e5f6... or explicitly mentioning that this is just one example and the pattern applies to all actions.

Suggested change

	> For additional security, you can pin actions to a specific commit SHA instead of a tag:
	> ```yaml
	> uses: qltysh/qlty-action/coverage@a1b2c3d4e5f6...
	> For additional security, you can pin actions to a specific commit SHA instead of a tag. This applies to all actions listed above:
	> ```yaml
	> uses: qltysh/qlty-action/<action>@a1b2c3d4e5f6...