Toggle ` Require actions to be pinned to a full-length commit SHA`

Depends on https://github.com/ramsey/composer-install/issues/275.

Currently this setting cannot be toggled, because it also applies to indirect actions used.