Enable applying security best practices using a CLI

[varunsh-coder]

gh CLI extension would be ideal since we will not need to solve for installation and authentication.

[sagikazarmark]

I'd say it would make sense if it worked as a standalone CLI tool as well.

Here is how I would probably use it:

• One mode of operation would be a "linter" mode that would run in GH Actions to catch "violations" (eg. action version not pinned)
• When a PR is opened with such violation, I probably wouldn't want to open yet another PR to fix it, but run the "fixer" locally and push the fix in the same PR.

A gh CLI extension sounds great when you first want to use the tool (eg. on a new repo), but to be perfectly honest, I really appreciated that for the first time I could go through the UI. The visual options and the preview helped a lot in understanding how this tool works/what it does. So for newcomers, I think the UI is a better choice.

[varunsh-coder]

Thanks, @sagikazarmark, for the feedback!