Fix actions_check_pinned_tags to work if `exclude` is omitted

[rdimitrov]

There's an issue that if we configure the rule like -

  - type: actions_check_pinned_tags
    def: {}

it fails to find any tags that are unpinned and always passes.

We should fix that by either making the exclude required or update the rego evaluation to work properly.