special action/checkout-v3.6.0 for nodejs20

Signed-off-by: Cary Phillips <cary@ilm.com>

Author: cary-ilm

.github/actions/checkout-v3.6.0/action.yml

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) Contributors to the OpenEXR Project.
+
+name: "Checkout v3.6.0"
+description: "Wrapper to pin actions/checkout to v3.6.0 so Dependabot won't attempt to update it."
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout fixed version
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

.github/workflows/ci_workflow_vfx.yml

@@ -127,7 +127,7 @@ jobs:
           curl --silent https://unofficial-builds.nodejs.org/download/release/v20.18.1/node-v20.18.1-linux-x64-glibc-217.tar.xz | tar -xJ --strip-components 1 -C /node20217 -f -
 
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: ./.github/actions/checkout-v3.6.0 # nodejs20 is incompatible with actions/checkout beyond v3.6.0
 
       - name: Configure
         run: |