feat: add bump-actions-versions composite action

[Copilot]

Adds a reusable composite action that audits .github/workflows/ for outdated action pins, bumps them to the latest release, and opens a PR — intended to run on a monthly schedule via the CCBR bot.

New composite action: bump-actions-versions

• Queries the GitHub Releases API for the latest tag of each referenced action
• Respects the pinning style in use:
  • v4 (major sliding) → v5 if a new major is released
  • v0.7 (major.minor sliding) → v0.8
  • v4.1.0 (full semver) → exact latest tag
  • Named refs (latest, stable) and commit SHAs → unchanged
• Lines annotated with # ccbr_actions:lock-version are skipped
• Uses actions/create-github-app-token (CCBR bot credentials) for commits and PR authorship
• Checks for an existing PR before creating one; uses git diff --cached --quiet guard before committing

Lock example

- uses: actions/checkout@v4 # ccbr_actions:lock-version  ← never bumped
- uses: actions/setup-python@v4                           ← bumped to v5 if released

Other files

• src/ccbr_actions/bump_versions.py — Python module (parse_action_ref, classify_ref, determine_new_ref, bump_workflow_file, bump_workflows)
• examples/bump-actions-versions.yml — monthly cron example workflow
• .github/workflows/bump-actions-versions.yml — live workflow for this repo
• tests/test_bump_versions.py — 46 unit tests, fully offline (mock sessions)

[codecov]

Codecov Report

❌ Patch coverage is 95.08197% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.55%. Comparing base (57be4d2) to head (ccd6a19).

Files with missing lines	Patch %	Lines
src/ccbr_actions/bump_versions.py	95.08%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #185      +/-   ##
==========================================
+ Coverage   94.43%   94.55%   +0.11%     
==========================================
  Files          11       12       +1     
  Lines         557      679     +122     
==========================================
+ Hits          526      642     +116     
- Misses         31       37       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.