Add secure-checkout action

[ianlewis]

Updates #968
Updates #795

Adds a secure-checkout action to replace the existing verify-checkout action.

verify-checkout checked if the checked out commit matched GITHUB_SHA which doesn't work if checking out the builder repo like the generate-builder action does which causes failures.

secure-checkout instead wraps the actions/checkout and forces the user to specify a git sha1 digest to check out and verifies that the checked out commit is the expected commit.

[asraa]

LGTM!

Assuming you'll move over checkouts in checkout-* in another PR and update the presubmit

[ianlewis]

LGTM!

Assuming you'll move over checkouts in checkout-* in another PR and update the presubmit

Yep. I need to get the action checked in before I can reference it so I'll send a follow up PR. Thanks for the review!