gh-actions-lockfile: generate and verify lockfiles for GitHub Actions