Add gha-shield to Tools

[Fabridev444]

Adds gha-shield to the Tools section.

What it is: browser + CLI + GitHub Action workflow security scanner. 13 categorized rules covering unpinned actions, command injection via interpolation, hard-coded provider keys, missing permissions, untrusted action receiving secrets, and 8 more. SARIF output integrates with the GitHub Security tab.

Differentiation vs the existing tools in the section:

• Unlike actionlint (lint correctness), it focuses on security findings.
• Unlike zizmor (CLI-only Rust), it ships browser-first (paste YAML, no install) AND as a Node CLI AND as an Action.
• Unlike poutine (binary install), it runs zero-install via npx Fabridev444/gha-shield.

Receipts:

• 48 unit tests pass (node --test)
• Real-world scans of vercel/next.js, prisma/prisma, oven-sh/bun, astral-sh/uv, vitest, archestra-ai (143 workflow files, 325 findings) documented at https://github.com/Fabridev444/gha-shield/blob/main/REAL-WORLD-AUDITS.md
• Browser: https://fabridev444.github.io/gha-shield/

License: MIT-pending.