Workflows pin third-party actions to mutable `@master` and `main` refs in four of eleven files

[bibonix]

Four workflow files install third-party actions from mutable refs while the other seven workflows in the same directory pin immutable versions, so any breaking upstream change lands silently in every CI run of every repository created from this template.

The mutable references:

• .github/workflows/actionlint.yml:21 curls https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash from the main branch.
• .github/workflows/shellcheck.yml:14 uses ludeeus/action-shellcheck@master.
• .github/workflows/pdd.yml:14 uses volodya-lombrozo/pdd-action@master.
• .github/workflows/xcop.yml:14 uses g4s8/xcop-action@master.

Compare with the pinned siblings in the same directory: rake.yml:14 (actions/checkout@v6), rake.yml:15 (ruby/setup-ruby@v1), reuse.yml:16 (fsfe/reuse-action@v6), typos.yml:16 (crate-ci/typos@v1.47.0), copyrights.yml:14 (yegor256/copyrights-action@0.0.12), markdown-lint.yml:14 (DavidAnson/markdownlint-cli2-action@v23.2.0), yamllint.yml:16 (ibiqlik/action-yamllint@v3). The pinned siblings prove the project's stated convention is to pin; the four exceptions break that convention.

Because this is a template repository, the defect propagates to every swarm derived from it.

Fix: replace each @master and the main branch reference with the latest published tag of the corresponding action (for example ludeeus/action-shellcheck@2.0.0, volodya-lombrozo/pdd-action@v0.0.21, g4s8/xcop-action@0.6, and the latest actionlint release tag in the download-actionlint.bash URL).

[bibonix]

@yegor256 happy to clarify the mutable-ref count or test the pinned replacements against a sample workflow run if it helps.