ci: pin checkout action by SHA, run on all branches

- Pin actions/checkout to full SHA (v4.2.2) to prevent mutable tag RCE
- Remove branch filter so CI runs on push to every branch, not just main

.gitea/workflows/check.yml

@@ -2,12 +2,11 @@ name: check
 
 on:
   push:
-    branches: [main]
   pull_request:
 
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - run: docker build .