The example megalinter workflow should use sha pinned actions

[daltonv]

Currently the example mega-linter.yml does not pin third part actions to shas

For example

- name: Commit and push applied linter fixes
   uses: stefanzweifel/git-auto-commit-action@v4

Instead of

uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4 

Since megalinter now includes v1.78 of the kics linter (as of megalinter v7.4.0)
and kics treats unpinned third-party actions as failures, megalinter should play by its own rules and tell users to pin to shas.

This advice even comes from github's own documentation

[nvuillam]

Kics is very chatty and kind of slow... for example I disabled it on own MegaLinter repo ;)

MegaLinter is a tool, but its users own the strategy to use it... I agree that pinning a sha on Github Actions is a good practice, but it's less readable, and I prefer MegaLinter to remain as simple as possible for newbies ^^

So users are free to update versions to shas, but I prefer not to enforce it in default workflows :)

[daltonv]

Fair enough. Good to understand the philosophy behind it.