The actions actions/checkout@v6.0.1, ossf/scorecard-action@v2.4.3, and github/codeql-action/upload-sarif@v4 are not allowed in hyperpolymath/im-docs because all actions must be pinned to a full-length commit SHA.