[EngSys] Add workflow to run `actionlint`

[mikeharder]

Linter for GitHub workflows, detects issues like shell injection vulnerabilities due to improper quoting/escaping.

name: ActionLint

on:
  push:
    branches:
      - main
    paths:
      - .github/**
  pull_request:
    paths:
      - .github/**
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            .github

      # Content copied from https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/.github/actionlint-matcher.json
      - name: Add ActionLint Problem Matcher
        run: echo "::add-matcher::.github/matchers/actionlint.json"

      - name: Lint workflows
        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
        with:
          args: -color -verbose