added the workflow and script to pin commit hash

[antedotee]

What this PR does:
This PR introduces a workflow and a script which will ensure every tag is pinned to the commit hash. If anything uses tag and not a commit hash, the workflow will fail and will tell you to run hack/gha-reversemap.sh apply-reversemap locally. I have also added .gha-reversemap.yml which will act as a single source of truth for approved hashes.

Why we need it:
For security purposes, makes the supply chain auditable

Which issue(s) this PR fixes:

Fixes #6492

[antedotee]

@khanhtc1202 Please take a look. Instead of raising PR solely for the workflow, the workflow was referencing the local script, so I added the local script here for end to end setup. I have run the script locally and it is working perfectly. If this gets merged, I think I can raise next PR for changing all the tags to commit hashes, and another PR for referencing the changes made in the documentation so that contributors can reference it to know what is going on.