test: exercise the action bump review on a real pull request

[helgafinn]

Deliberately moves the actions/checkout pin backwards so the review workflow has a genuine bump to analyse.

This verifies the part fixtures cannot: that the Action runs correctly inside a real GitHub Actions job, consumed through uses: ./, and posts its review as a pull request comment.

Will be closed once the run is confirmed.

[github-actions]

Pinned action review

Highest finding: MEDIUM.

actions/checkout

fbc6f3992d24 → 08c6903cd8c0

Severity	Finding
MEDIUM	Input "allow-unsafe-pr-checkout" was removed and is now ignored if still passed.

_{1 bump reviewed, 0 critical, 0 high, 1 medium, 0 low, 0 informational.}

[helgafinn]

Verified: the Action ran in a real job, fetched both revisions, correctly identified that allow-unsafe-pr-checkout exists in v5.1.0 and not v5.0.0, and posted the review as a comment. Confirmed by hand against both action.yml files. Closing — the pin stays at v5.1.0 on main.