Document controlled major tags for owned automation

[MariusStorhaug]

Context and request Document the confirmed supply-chain policy for GitHub Actions and reusable workflows: automation owned by MSX or an initiative may use a controlled floating major tag so compatible releases roll out centrally, while external actions remain pinned to immutable commit SHAs. ## Acceptance criteria - The GitHub Actions standard distinguishes external references from organization- or initiative-owned automation. - External actions and reusable workflows remain pinned to full 40-character commit SHAs. - Owned automation may use a floating major tag only when controlled release automation maintains it and advances it solely to compatible stable releases in that major. - Breaking releases create a new major line and move consumers through a deliberate fleet campaign rather than repointing an existing major tag. - Security, dependency, release, review, and fleet-orchestration guidance uses consistent wording without relaxing unrelated dependency controls. - Documentation validation passes. ## Technical decisions - Update the existing GitHub Actions standard as the canonical authoring rule; do not create a parallel policy page. - Treat GitHub-owned and marketplace actions as external because MSX does not control their release automation. - Keep immutable semantic version tags and moving major aliases distinct in release-management guidance. - Use the existing Fleet Orchestration campaign model for breaking-major consumer migrations. ## Implementation plan - [x] Verify current cross-references and validation expectations before changing policy wording. - [x] Update src/docs/Coding-Standards/GitHub-Actions.md with the ownership-based rule and examples. - [x] Align the security and dependency standards with the controlled exception. - [x] Constrain sliding major tags in release management and document breaking-major fleet campaigns. - [x] Update review guidance so it checks either an external SHA pin or a compliant owned-major reference. - [x] Run documentation index, link, and Pester validation.