Add githubactions ecosystem

[andrew]

git-pkgs/manifests parses .github/workflows/*.yml into pkg:githubactions/<owner>/<repo>@<ref> dependencies. registries.NewFromPURL returns unknown ecosystem: githubactions for these, so consumers that fetch artifacts (git-pkgs licenses --license-text, integrity verification) have to skip the whole ecosystem.

Actions are git repositories on github.com. A ref's source tarball is at https://github.com/<owner>/<repo>/archive/<ref>.tar.gz, which covers URLs.Download. URLs.Registry would be the marketplace or repo page. FetchPackage and FetchVersions map to the GitHub REST API (/repos/<owner>/<repo>, /repos/<owner>/<repo>/tags), rate-limited to 60 req/hour without a token.

Complications worth noting:

• Subdirectory actions (pkg:githubactions/github/codeql-action/init@v3) share a repo; the tarball is the whole repository.
• Refs may be tags, branch names, or 40-char SHAs. Download accepts any of them; FetchVersions would enumerate tags only.
• /archive/<ref>.tar.gz is generated on demand and GitHub does not guarantee byte-stability across regenerations, so stored checksums may not match a later download. Release assets are stable but not every action publishes them.

A first cut could register the ecosystem with URLs.Download and URLs.Registry populated and return nil from the Fetch* methods.