Remove ref for internal action calls

[laurentsimon]

Remove the ref we use to call internal actions, Instead, checkout the builder repo and calls them locally.

closes #880

[laurentsimon]

@ianlewis appreciate feedback and questions, since this seems to undo some of the secure-checkout code. I want to be sure I'm not mis-understanding something.

[asraa]

lgtm, after I understand now the user risk and interaction here.

[ianlewis]

@laurentsimon Since you mentioned actions/checkout pulls a tar, I wondered if that tar could somehow be overwritten with a dirty checkout such that git log -1 --format='%H' returns the right SHA but the checkout itself it dirty and contains different code.

Maybe not necessary for this PR but we could maybe add a check for git status or git diff in the future.

[ianlewis]

@ianlewis appreciate feedback and questions, since this seems to undo some of the secure-checkout code. I want to be sure I'm not mis-understanding something.

I think this is fine. I wasn't totally confident secure-checkout was solving the issue properly anyway.

[ianlewis]

Related #626