Add Macaron GitHub Action Check

[anshisinghh]

Summary

Add Macaron policy verification for GitHub Actions using the check-github-actions policy.

What this change does

• Adds a dedicated workflow for Macaron verification
• Checks workflow definitions and local composite actions
• Uses pinned actions and disables persisted checkout credentials

Why this is required

This helps detect unsafe or vulnerable GitHub Actions usage and reduces risk from software supply chain attacks targeting CI/CD pipelines.

Required follow-up

• Enable Macaron policy verification as a required status check for protected branches
• Resolve any policy findings before merge if applicable